I want to change the source on my request when the timechange.
I have a lot of directories named by date and I use this as the source.
When I change the date, I need to change the source value.
So, if the earliest time search equals 20160522, then my search will be:
My test is:
index=myindex |addinfo | eval time1=strftime(info_min_time, "%Y%m%d") |where source=time1 |table field1 field2 ......
but this doesn't work for me and I don't know how I can do this.
if any body have a solution thx
Try like this
index=myindex [| gentimes start=-1 | addinfo | eval source=strftime(info_min_time, "%Y%m%d") | table source ] | rest of your search
View solution in original post
It works very well.
What about if I want to search one day ago?
I tried this, but it does not work:
index=myindex [| gentimes start=-1 | addinfo | eval source=relative_time(strftime(info_min_time,"-1d@d"), "%Y%m%d") | table source ]