Splunk Search

Using single column Holiday table how do I determine whether today is a holiday?

pm771
Communicator

I have a lookup CSV table that lists dates of holidays in a single column.

HolidayTable.csv:

HDate
1/1/2020
...................

 

I tried to use the following:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT HDate as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

My expectation was that when the current date matches a row in the table I will get the date  string and otherwise - null.

It does not seem to work this way.

What am I missing here?

 

Labels (1)
0 Karma
1 Solution

pm771
Communicator

[Following up with my own solution]

I ended up with creating a dummy 2nd column.

HDateOff
1/1/2020Y
...................Y

 

And with a slight change (used new column as returned value) my code started working:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

 

View solution in original post

0 Karma

pm771
Communicator

[Following up with my own solution]

I ended up with creating a dummy 2nd column.

HDateOff
1/1/2020Y
...................Y

 

And with a slight change (used new column as returned value) my code started working:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your currentdate date format is wrong based on your example of 01/01/2020 in the CSV. Your format is

%-m/%-d

but it should be %m/%s, so it has leading zeros

 

0 Karma

pm771
Communicator

It was a typo in my question. Month and day in my table are without leading zeroes.

Since the table is going to be maintained via Excel, I had to use the default date format.

I will update the question.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...