How to run a certain eval statement in a search based on the date range?

[tlmayes]

Creating a table for time zones, which will be used to keep track of our universal forwarders and their settings. Need the table to know the difference between daylight savings time and standard time, so thought I would execute a particular eval based on the date, but am not having any luck.

Sample evals (truncated for this question. I want to use Eval 1 if between Mar26 & Oct29. Otherwise, I want to use Eval 2

Eval 1:

| eval TZ=case(date_zone==60,"CET",date_zone==600,"AEDT",date_zone==330,"",date_zone==120,"EET")

Eval 2:

| eval TZ=case(date_zone==,120"CEST",date_zone==660,"AEST",date_zone==330,"IST",date_zone==180,"EEST")

[somesoni2 · Accepted solution]

How about this?

your search  | eval TZ1=case(date_zone==60,"CET",date_zone==600,"AEDT",date_zone==330,"",date_zone==120,"EET")
| eval TZ=case(date_zone==120,"CEST",date_zone==660,"AEST",date_zone==330,"IST",date_zone==180,"EEST")
| eval TZ=if(_time>=strptime(strftime(_time,"%Y-")."03-26","%Y-%m-%d") AND _time<=strptime(strftime(_time,"%Y-")."10-29","%Y-%m-%d"),TZ1,TZ) | fields - TZ1

[tlmayes]

Yes, that does it. Always seems simple when you have the answer in front of you 😕 Have a great weekend, and thanks