Lookup Definition using Match Type

[jackreeves]

I am attempting to create a new "Week" field based on an external lookup.

However, the date field in my sourcetype and lookup DO NOT match. The date field in the sourcetype is in following format %d/%m/%Y %H:%M (e.g. 31/05/2018 00:05). The Date field in my lookup table is in following format %d/%m%/Y (e.g. 31/05/2018).

Can I use Match Type in lookup definition to use a wildcard on Date field in order to return "Week" field? Can't seem to get it to work.

Thanks,
Jack

[woodcock]

That feature does not work anything like what you need. Skip the lookup and just use something like this:

|makeresults | eval date="31/05/2018 00:05"
| eval _time = strptime(date, "%d/%m/%Y %H:%M")
| eval week=strftime(_time, "%Y-W%0W-%0w")