Search eval strftime result of current day across lookup.

[middlemiddle]

I'm using the following to eval current_day:

| inputlookup Files_And_Thresholds
| eval current_day=lower(strftime(relative_time(now(),"@s"),"%A"))

I have a column in a lookup file (.csv) with days '"file_days" I would like to search across, I can not figure out why this will not search?  If I replace current_day with the string "tuesday" it works fine?

| makemv delim=" " file_days

| search file_days=current_day

lookup table:

file_cutoff_time file_days file_name
23:00:00 thursday wednesday FILE001.CSV
22:00:00 friday monday thursday tuesday wednesday FILE002.CSV

[kamlesh_vaghela]

@middlemiddle 

Is this lookup comma separated OR space separated?

KV 

[kamlesh_vaghela · Accepted solution]

@middlemiddle 

Try this.

| inputlookup lookup.csv | eval current_day=lower(strftime(relative_time(now(),"@s"),"%A")) | where like(file_days,"%".current_day."%")

I have assumed below csv file.

file_cutoff_time,file_days,file_name
23:00:00,thursday wednesday,FILE001.CSV
22:00:00,friday monday thursday tuesday wednesday,FILE002.CSV

KV 

[middlemiddle]

space separated.

[kamlesh_vaghela]

@middlemiddle 

Can you please share Files_And_Thresholds stanza from transforms.conf ?