Getting Data In

I have a Report running on cron schedule but want to exclude running on federal holidays

gnshah12345
New Member

I have created a csv file with dates of federal holidays.
holiday_date
01/01/19
01/21/19

I am trying to run my search like below.
index=appxindex |eval today_date=strftime(_time,"%m/%d/%y") | search NOT [|inputlookup exclude_holidays.csv holiday_date as today_date ]
The above is not working. All I want to do is if today_date = holiday_date (in csv file), I do not want to search. Any ideas?

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@gnshah12345 ,

inputlookup doesnt have AS clause.

Try

index=appxindex |eval holiday_date=strftime(_time,"%m/%d/%y") 
| search NOT [|inputlookup exclude_holidays.csv|fields holiday_date]

OR

index=appxindex |eval today_date=strftime(_time,"%m/%d/%y") 
| search NOT [|inputlookup exclude_holidays.csv|rename holiday_date as today_date ]
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!