Hello, How to search based on drop-down condition? Thank you in advance!
index = test
| eval week_or_day_token = "w" (Drop down: if select "week" = "w", "day" = "d)
| eval day_i...
See more...
Hello, How to search based on drop-down condition? Thank you in advance!
index = test
| eval week_or_day_token = "w" (Drop down: if select "week" = "w", "day" = "d)
| eval day_in_week_token = 1 (Drop down: if select 0=Sunday, 1=Monday, 2=Tuesday, and so on)
If week_or_day_token is "week", then use day_in_week_token, otherwise if week_or_day_token is "day" , then use all day *
| eval day_in_week = if(week_or_day_token="w", day_in_week_token, "*")
Get what day number in week on each timestamp
| eval day_no_each_timestamp = strftime(_time, "%" + day_in_week_token)
I searched the timestamp that falls on Monday (day_in_week=1), but I got 0 events
| search day_no_each_timestamp = day_in_week
If I replaced it with "1", it worked, although the value day_in_week is 1
| search day_no_each_timestamp = "1"