Help refining .csv lookup evals, data not outputting properly

[chorn3567]

hi! 

Working on adding a holiday table as a lookup to reference for alerts based on volume and want to alert on different thresholds if its a holiday. the referenced search is showing data for 7/10 as nonHoliday, even though for a test, i have it listed as a holiday in the lookup file. 

its a .csv, so no initial formatting seems to be passing thru the file, need to format the holidayDate column in mm/dd/yyyy

index=my_index
| eval eventDate=strftime(_time, "%m/%d/%Y")
| lookup holidayLookup.csv holidayDate as eventDate OUTPUT holidayDate
| eval dateLookup = strftime(holidayDate, "%m/%d/%Y")
| eval holidayCheck=if(eventDate == dateLookup, "holiday", "nonHoliday")
| fields eventDate holidayCheck
| where holidayCheck="nonHoliday"

screen shot shows its captured the event date as expected and is outputting a value for holidayCheck, but, based on the data file its referencing, it should show as Holiday. 

data structure

holidayDate	holidayName
07/10/2024	Testing Day
07/04/2024	Independence Day

[PickleRick]

I'm a bit lost here. Either you miscopypasted here or it has no chance of ever matching.

You have eventDate as a string produced by strftime, you use it to find something in your lookup, then you strptime a possible match to a nummeric value dateLookup. There is no way that eventDate will ever be equal to dateLookup. One is a string, another is a number.

[yuanliu]

To make this question answerable, you need to also illustrate the content of your lookup.  Perhaps your lookup doesn't contain year? (Sometimes it makes more sense to not have year than having year.)  Also, if you only want to show events on nonHoliday, why the complicated post calculations?

Assuming your lookup is like

holidayDate	holiday
1/1	New Year's Day
7/10	Don't Step on a Bee Day

all you need is

index=my_index
| eval eventDate=strftime(_time, "%m/%d")
| lookup holidayLookup.csv holidayDate as eventDate OUTPUT holidayDate
| where isnull(holidayDate)