Hi,
I'm using a lookup which stores maintenance periods and can be used to exclude events of downtime from my main query.
My Lookup looks this way:
Numbers StartDateTime EndDateTime
1 2014/01/21 01:00:00 2014/01/22 01:00:00
2 2015/02/21 02:00:00 2014/01/23 01:00:00
The query that I've used is:
|base query|[ | inputlookup mainteinance_time | eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time="NOT (_time>"+start+" AND _time<"+end+")"
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search
This is returning me the correct events. The only problem over here is I'm having the pass the number of rows in the lookup in the "return" function before $time. Is there a way I can recursively do it without having to mention the number? Like calculating the number of rows present and passing the value? How do I build my query on those lines?
