Hello everybody,
I have a question for the community:
Is there a reverse split command?
I'll explain my problem:
I have a:
| eval Holidays = "01 / 01.01 / 06.08 / 15.11 / 01.12 / 08.12 / 25.12 / 26.05 / 01.04 / 25.06 / 02"
with the holidays that I want to remove from the day count
(I create it, it can be a single value or a multivalue) now I have to add the current year:
| eval year = strftime (now (), "% Y")
and have this day excluded from the final count:
| eval dates = mvrange (C3, now (), 86400)
| eval dates = mvfilter (NOT match (dates, "(Excluded)"))
| convert ctime (dates) timeformat = "% A"
| eval dates = mvfilter (NOT match (dates, "(Saturday | Sunday)"))
| eval noOfDays = mvcount (dates)
I want to create an Excluded field that has holidays with the current year as value for example:
Excluded = "1640991600.000000 | 1641423600.00000 | 1660514400.000000 | ........"
It's possible?
Is there a reverse split command?
Tks
Br
| makeresults
| eval Holidays = "01 / 01.01 / 06.08 / 15.11 / 01.12 / 08.12 / 25.12 / 26.05 / 01.04 / 25.06 / 02"
| streamstats count as row
| eval Holidays = split(Holidays,".")
| mvexpand Holidays
| eval Holidays = strftime(now(),"%Y / ").Holidays
| eval Holidays = strptime(Holidays, "%Y / %m / %d")
| stats values(*) as * by row
| eval Holidays=mvjoin(Holidays,"|")
Hi ITWhisperer,
thanks for the solution !!
It works perfectly.
Thank you so much
| makeresults
| eval Holidays = "01 / 01.01 / 06.08 / 15.11 / 01.12 / 08.12 / 25.12 / 26.05 / 01.04 / 25.06 / 02"
| streamstats count as row
| eval Holidays = split(Holidays,".")
| mvexpand Holidays
| eval Holidays = strftime(now(),"%Y / ").Holidays
| eval Holidays = strptime(Holidays, "%Y / %m / %d")
| stats values(*) as * by row
| eval Holidays=mvjoin(Holidays,"|")