Hello, I have an inputlookup table (test.csv) with a few columns including 7 columns (for 7 days of the week) as shown below. FILENAME Monday Tuesday Wednesday Thursday Friday Saturday Sunday abc 1 2 3 4 5 X X xyz 11 2 30 4 5 X X 123 111 2 300 40 5 X X   I need to pull the column corresponding to the execution day. For example, if i execute it on 6/23/2020 (date being Wednesday), I should get something like this. FILENAME Count abc 3 xyz 30 123 300   If I run this search on 6/27/2020, being a Saturday, I should get something like this - FILENAME Count abc X xyz X 123 X   I tried something like this but it isn't working - | inputlookup test.csv |  eval wkday = strftime(now(),"%A") | eval Count = {wkday}   Any help would be greatly appreciated. ... View more

I am using inputlookup in a search query and search key in table (test.csv) has wildcard as shown below. FILENAME EMAIL abc* [email protected] xyz* [email protected]   The query should match fname in log file with FILENAME from lookup table and if there's a match then result should be something like: FILENAME EMAIL cnt abc* [email protected] 2 xyz* [email protected] 0   Instead my query output is: fname EMAIL count abc* [email protected] 0 abc123.txt   1 abc.dat   1 xyz* [email protected] 0   This is my query: index=* host=* source="/bustools/*" | rex max_match=100 "\d+\d+\s(?<ts>.*)\s(?<directory>\/.*)\/(?<fname>.*)" | dedup fname | search [ | inputlookup test.csv | rename FILENAME AS fname | fields fname] | stats count as occur by fname | append [ inputlookup test.csv | rename FILENAME AS fname | fields fname] | fillnull occur | stats sum(occur) as cnt BY fname | join type=left fname [ | inputlookup test.csv | rename FILENAME AS fname] | table fname EMAIL cnt Any help would be appreciated. ... View more