Splunk Search

Using single column Holiday table how do I determine whether today is a holiday?

pm771
Communicator

I have a lookup CSV table that lists dates of holidays in a single column.

HolidayTable.csv:

HDate
1/1/2020
...................

 

I tried to use the following:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT HDate as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

My expectation was that when the current date matches a row in the table I will get the date  string and otherwise - null.

It does not seem to work this way.

What am I missing here?

 

Labels (1)
0 Karma
1 Solution

pm771
Communicator

[Following up with my own solution]

I ended up with creating a dummy 2nd column.

HDateOff
1/1/2020Y
...................Y

 

And with a slight change (used new column as returned value) my code started working:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

 

View solution in original post

0 Karma

pm771
Communicator

[Following up with my own solution]

I ended up with creating a dummy 2nd column.

HDateOff
1/1/2020Y
...................Y

 

And with a slight change (used new column as returned value) my code started working:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your currentdate date format is wrong based on your example of 01/01/2020 in the CSV. Your format is

%-m/%-d

but it should be %m/%s, so it has leading zeros

 

0 Karma

pm771
Communicator

It was a typo in my question. Month and day in my table are without leading zeroes.

Since the table is going to be maintained via Excel, I had to use the default date format.

I will update the question.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...