eval strftime to create current_hour (HH:MM) to be used with inputlookup fields

[middlemiddle]

I have a lookup with the files that should be sent each hour (common/flat file names) with the hour as the header, I would like to use an eval to set current hour to use to pull back thresholds in lookup with # of files for that hour:

| eval current_hour=strftime(now(),"%H:00")

Use the above with inputlookup to pull back fields "field file_names 14:00" as an example:

| inputlookup file_monitoring_.csv | fields $current_hour$

lookup is like below:

file_name,00:00,01:00,02:00,03:00,etc...
file001.csv,5,10,15,20,etc....
file002.csv,0,0,0,1,etc....
file007.csv,105,206,409,727,etc....
file009.csv,1,2,3,4,etc....

[ITWhisperer · Accepted solution]

Try something like this:

| eval current_hour=strftime(now(),"%H:00")
| inputlookup file_monitoring_.csv
| foreach *
  [ eval keep=if("<<FIELD>>"=current_hour,'<<FIELD>>',keep)]
| fields keep

[middlemiddle]

Works like a charm, thank you.