When using a lookup, it's normal to just use that as a lookup rather than a data source using inputlook which you then have to join with your other data set as you are doing with your appendcols. If ...
See more...
When using a lookup, it's normal to just use that as a lookup rather than a data source using inputlook which you then have to join with your other data set as you are doing with your appendcols. If this is your base search for data index=splunk-index
| where message="start"
| where NOT app IN("ddm", "wwe", "tygmk", "ujhy")
|eval day= strftime(_time, "%A")
|where _time >= relative_time(_time, "@d+4h") AND _time <= relative_time(_time, "@d+14h")
|where NOT day IN("Tuesday", "Wednesday", "Thursday") you just need to add the following to lookup the | eval Event_Date=strftime(_time, "%m/%d/%Y")
| lookup HolidayList.csv Holidays_Date as Event_Date OUTPUT Alert
| where isnull(Alert) OR Alert!="App Relative Logs Data" I would also suggest you change your initial search to move the static search criteria in the where clause to the search and do the strftime just before it's needed, i.e. index=splunk-index message="start" NOT app IN("ddm", "wwe", "tygmk", "ujhy")
| where _time >= relative_time(_time, "@d+4h") AND _time <= relative_time(_time, "@d+14h")
| eval day=strftime(_time, "%A")
| where NOT day IN("Tuesday", "Wednesday", "Thursday")