timefield in lookup

[krugger]

I have created a lookup to represent the holidays of a year, however I can't match the date to the _time. I have defined that the field holiday in the lookup holiday is a timefield.

holidays.csv:
holiday,type,desc
25-12-2012,global,Christmas
...

query:
index="physical" | lookup holidays holiday
produces error: "You cannot use timefield as a lookup field"

transform.conf:
[holidays]
filename = holidays.csv
time_field = holiday
time_format = %m-%d-%Y

The objective is to have all logs related to weekends and holidays.

[lguinn2 · Accepted solution]

Hmmm, in your transforms.conf, you have the date as month-day-year, but in the csv file, the date is day-month-year. Perhaps that is the problem?

Or, try this query instead

index="physical" 
| eval holiday=strftime(_time,"%d-%m-%Y")
| lookup holidays holiday

This creates a field named holiday for each event, with a string format that matches the string format in your lookup table. Therefore, you should be able to change your transforms.conf to

[holidays]
filename = holidays.csv
default=not a holiday
min_matches = 1

And no time-based lookup will be needed. Note that this also will return the value "not a holiday" for any date that doesn't match an item in the table.

[krugger]

Done. Added the content of transform.conf

[lguinn2]

Can we see the transforms.conf entry that defines this lookup table? My guess is that something is missing, but there isn't quite enough info in your question. Thanks!