Splunk Search

Using single column Holiday table how do I determine whether today is a holiday?

pm771
Communicator

I have a lookup CSV table that lists dates of holidays in a single column.

HolidayTable.csv:

HDate
1/1/2020
...................

 

I tried to use the following:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT HDate as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

My expectation was that when the current date matches a row in the table I will get the date  string and otherwise - null.

It does not seem to work this way.

What am I missing here?

 

Labels (1)
0 Karma
1 Solution

pm771
Communicator

[Following up with my own solution]

I ended up with creating a dummy 2nd column.

HDateOff
1/1/2020Y
...................Y

 

And with a slight change (used new column as returned value) my code started working:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

 

View solution in original post

0 Karma

pm771
Communicator

[Following up with my own solution]

I ended up with creating a dummy 2nd column.

HDateOff
1/1/2020Y
...................Y

 

And with a slight change (used new column as returned value) my code started working:

 

 

 

search ...
| eval currentdate=strftime(now(),"%-m/%-d/%Y") 
| lookup HolidayTable.csv HDate as currentdate OUTPUT Off as Holiday
| eval Holiday=if(isnull(Holiday), "N", "Y")

 

 

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your currentdate date format is wrong based on your example of 01/01/2020 in the CSV. Your format is

%-m/%-d

but it should be %m/%s, so it has leading zeros

 

0 Karma

pm771
Communicator

It was a typo in my question. Month and day in my table are without leading zeroes.

Since the table is going to be maintained via Excel, I had to use the default date format.

I will update the question.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...