Splunk Search

Search eval strftime result of current day across lookup.

middlemiddle
Explorer

I'm using the following to eval current_day:

| inputlookup Files_And_Thresholds
| eval current_day=lower(strftime(relative_time(now(),"@s"),"%A"))

I have a column in a lookup file (.csv) with days '"file_days" I would like to search across, I can not figure out why this will not search?  If I replace current_day with the string "tuesday" it works fine?

| makemv delim=" " file_days

| search file_days=current_day

lookup table:

file_cutoff_time file_days file_name
23:00:00 thursday wednesday FILE001.CSV
22:00:00 friday monday thursday tuesday wednesday FILE002.CSV

Labels (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@middlemiddle 

Try this.

| inputlookup lookup.csv | eval current_day=lower(strftime(relative_time(now(),"@s"),"%A")) | where like(file_days,"%".current_day."%")

 

I have assumed below csv file.

file_cutoff_time,file_days,file_name
23:00:00,thursday wednesday,FILE001.CSV
22:00:00,friday monday thursday tuesday wednesday,FILE002.CSV

 

KV 

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@middlemiddle 

Is this lookup comma separated OR space separated?

KV 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@middlemiddle 

Try this.

| inputlookup lookup.csv | eval current_day=lower(strftime(relative_time(now(),"@s"),"%A")) | where like(file_days,"%".current_day."%")

 

I have assumed below csv file.

file_cutoff_time,file_days,file_name
23:00:00,thursday wednesday,FILE001.CSV
22:00:00,friday monday thursday tuesday wednesday,FILE002.CSV

 

KV 

0 Karma

middlemiddle
Explorer

space separated.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@middlemiddle 

Can you please share Files_And_Thresholds stanza from transforms.conf ?

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...