Where condition based on date / time for imported data

[ozirus]

Hi,

I've a CSV imported data (hostname = AVGMAILCOUNT) and want to use its data based on present time values.

What I'm trying to do is searching that data according to current time parameters but i get error; (Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.)

I want search all data historially but for only same days (mondays for example)

Query gives above error;

host="AVGMAILCOUNT" date_wday = [ search eval A=strftime(now(),"%A") | return A]

Regards,

[gfuente · Accepted solution]

Hello

Use this subsearch instead:

host="AVGMAILCOUNT" date_wday = [|stats count | eval A=strftime(now(),"%A") | return $A]

regards