I have a table with an ID in it and a date. I've converted the date to be YYYYMMDD . Based on that date field, I would like to create a whole new column that takes the current date field and adds a month to populate the column/row. I don't want to use relative now() time, I want to take my data point and add a month to it. So my search is index=product_index punct="__::_..___::_:_:____'_______,__\\\\____'" | convert ctime(_time) as monitor_start timeformat=%Y-%m-%d| table Employee_ID, monitor_start, monitor_end | outputlookup users.csv I need to add another pipe that does something such as |eval monitor_end=(monitor_start+1mon) but that doesn't work. If I can get a new column called monitor_end, I would do a format on that as well. | convert ctime(monitor_end) timeformat=%Y-%m-%d ... View more

Does anyone know if this is possible? I have a search that works that gives me results for a particular user from a csv. | inputlookup ldapsearch_corporate_identities | search identity="particular userid" This lookup gives me the AD information for "particular userid". I have another csv being generated with a list of userids that we want to pull information for. I'm wondering if I can get the first search to run and return results for each user listed in the second csv. Below is what I have so far. The search itself does list each userid in my csv. But I can't seem to get them to work together. Each user id is listed in a column called target_userid. | inputlookup ldapsearch_corporate_identities|search [|inputlookup machines.csv |fields target_userid | dedup target_userid | mvexpand target_userid] | search identity=target_userid ... View more