@bowesmana, thanks for this. It worked brilliantly.. i will accept this as answer for this question. BUt again, just out of curiosity, is there any way to change rex pattern dynamically? i mean the way i was trying (obviously i ws doing something wrong)?
... View more
Hello All, I hope you all are doing well. I have a situation wherein i have to pass current day value (Sun, Mon, Tue etc) in regex dynamically to capture a value associated which i have in lookup for that day. I have a lookup, maintenance.csv with below fields. host; maintenance_days host1; Sun=1, Mon=2, Tue=3 and so on What i want is, depending on the day on which my search is ran, it should fetch value the corresponding value of the day. For example, if my search runs on Mon, it should return 2, if it runs on Tue, it should return 3 etc. I thought i can do this by calculating the day on the search time and passing this as variable in my regex and extracting the value for the day (1, 2, 3 etc) by using fields in rex command but its not working. Search: | inputlookup "maintenance.csv" | eval date_wday=strftime(strptime(now(),"%d/%m/%Y"),"%a") | rex field=maintenance_days "date_wday\=(?P<mday>[^,])" What i need is, if above search is run on "Mon", then regex in search becomes, "| rex field=maintenance_days "Mon\=(?P<mday>[^,])"". If it runs on Wednesday, then it becomes "| rex field=maintenance_days "Wed\=(?P<mday>[^,])"" etc. I have tried $date_way$ instead of date_wday but it didnt worked. I have tried putting "| rex field=maintenance_days "date_wday\=(?P<mday>[^,])"" inside a macro and passing "date_wday" as argument, but it again took it as a string instead of field value associated with it. I did had some sucess in passing field value via map command but i am just wondering if there is any nicer way of doing this.
... View more