How to compare using eval expression and field value pair

[k_harini]

I want the table to be generated based on 2 conditions - one condition is comparing eval expression and other field value pair.. how to do that
index="myindex" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) AND ('System Status'!="Completed")

This where clause is not working.. please help

[javiergn]

I can see two issues:

1) Your "|table ID,Category" is getting rid of some fields you are using later on such as now_time, System Status or Due_Date_Time.
2) I think this part is also going to cause you a headache as you are not comparing integers with integers, just strings with strings:

 where (now_time>=Due_Date_Time)

Can you try this instead?

index="myindex" 
|eval Due_Date_Epoch = strptime('Due By',"%d.%m.%Y")
|table ID, Category, Due_Date_Epoch, 'System Status'
| where (now() >= Due_Date_Epoch) AND ('System Status'!="Completed")

Thanks,
J

[k_harini]

Thanks for your reply. This is also not working..

[inventsekar · Accepted solution]

i dont have logs to test this, can you check this once -

index="myindex" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) | search 'System Status'!="Completed"

or even, you can try checking the System Status at first stage itself -

index="myindex" 'System Status'!="Completed" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) 

[k_harini]

Thanks for your reply.. both are not working

second one works till here.. where clause time condition not working 😞
index="myindex" "System Status"!="Completed"|eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category

[inventsekar]

 index="myindex" 'System Status'!="Completed"
  |eval Due_Date = strptime('Due By',"%d.%m.%Y") 
  | where (now() >= Due_Date)
  |table ID, Category

[k_harini]

It worked the way i wanted.. Thank you so much..