Splunk Search

How edit my search to exclude holidays (with the help of lookup)?

Engager
 eval dates=mvrange(strptime(insrt_date,"%Y-%m-%d"),strptime(updt_date,"%Y-%m-%d"),86400) | convert ctime(dates)  timeformat="%A" | eval dates=mvfilter(NOT match(dates,"(Saturday|Sunday)")) 

I have my search to exclude the weekends. Can someone help me with how to include lookup in my search so it excludes the days present in my holiday lookup?

0 Karma

Legend

Try this

eval date=mvrange(strptime(insrt_date,"%Y-%m-%d"),strptime(updt_date,"%Y-%m-%d"),86400) | convert ctime(date) as dates  timeformat="%A" | eval dates=mvfilter(NOT match(dates,"(Saturday|Sunday)")) | mvexpand date  | search NOT [| inputlookup lookupfile.csv | eval datefield=strptime(datefield, "%Y-%m-%d") | rename datefield=date | fields date]

Engager

Can you please show me how my lookup table should look like?

0 Karma

Engager

It is not giving me dates in a single cell of the same daterange but instead its dividing it. Please help

0 Karma

Legend

Your lookup table should have at least the date for the holidays in a field called datefield. The format for the dates should be %Y-%m-%d. You can have additional fields, if you choose.

0 Karma

Engager

It is not giving me dates in a single cell of the same daterange but instead its dividing it. Please help

0 Karma

Legend

Not sure I understand. Can you share some samples?

0 Karma

Engager
eval date=mvrange(strptime(insrt_date,"%Y-%m-%d"),strptime(updt_date,"%Y-%m-%d"),86400)

this will give me dates in a single row cell like below

1.  2016-09-23
     2016-09-24
     2016-09-25
     2016-09-26

Now when i put the date for the lookup to compare and exclude holidays it gives me dates in different rows like

1.  2016-09-23
2.  2016-09-24
3.  2016-09-25
4.  2016-09-26

I don't want them in different rows

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!