Creating a table for time zones, which will be used to keep track of our universal forwarders and their settings. Need the table to know the difference between daylight savings time and standard time, so thought I would execute a particular eval based on the date, but am not having any luck.
Sample evals (truncated for this question. I want to use Eval 1 if between Mar26 & Oct29. Otherwise, I want to use Eval 2
Eval 1:
| eval TZ=case(date_zone==60,"CET",date_zone==600,"AEDT",date_zone==330,"",date_zone==120,"EET")
Eval 2:
| eval TZ=case(date_zone==,120"CEST",date_zone==660,"AEST",date_zone==330,"IST",date_zone==180,"EEST")
How about this?
your search | eval TZ1=case(date_zone==60,"CET",date_zone==600,"AEDT",date_zone==330,"",date_zone==120,"EET")
| eval TZ=case(date_zone==120,"CEST",date_zone==660,"AEST",date_zone==330,"IST",date_zone==180,"EEST")
| eval TZ=if(_time>=strptime(strftime(_time,"%Y-")."03-26","%Y-%m-%d") AND _time<=strptime(strftime(_time,"%Y-")."10-29","%Y-%m-%d"),TZ1,TZ) | fields - TZ1
How about this?
your search | eval TZ1=case(date_zone==60,"CET",date_zone==600,"AEDT",date_zone==330,"",date_zone==120,"EET")
| eval TZ=case(date_zone==120,"CEST",date_zone==660,"AEST",date_zone==330,"IST",date_zone==180,"EEST")
| eval TZ=if(_time>=strptime(strftime(_time,"%Y-")."03-26","%Y-%m-%d") AND _time<=strptime(strftime(_time,"%Y-")."10-29","%Y-%m-%d"),TZ1,TZ) | fields - TZ1
Yes, that does it. Always seems simple when you have the answer in front of you 😕 Have a great weekend, and thanks