Hi, What I am trying to do, is to determine from a lookup table whether we have a maintenance window active in order to effectively disable a number of alerts. Excluding the log lines from the searches is not an option, because the alerts will interpret that as an error situation since the successfull cases would be missing. I already have a lookup table containing the start and end times for the maintenance windows. The following produces promising results: | inputlookup maintenancetimes.csv
| convert timeformat="%Y/%m/%d %H:%M:%S %p" mktime(MaintStart) mktime(MaintEnd)
| eval Break=if( now() > MaintStart AND now() < MaintEnd, "Yes", "") | sort -Break
| return 500 Break The result is (Break="Yes") OR (Break="") Which I interpret as presence of both active and inactive maintenance windows. However, when I am trying to use the data from a subsearch, it isn't doing what I want. | makeresults count=2 annotate=true
| eval IsBreak=if(match([
| inputlookup maintenancetimes.csv
| convert timeformat="%Y/%m/%d %H:%M:%S %p" mktime(MaintStart) mktime(MaintEnd)
| eval Break=if( now() > MaintStart AND now() < MaintEnd, "Yes", "") | sort -Break
| return 500 $Break ],"Yes"),1,0)
| table IsBreak _time The results show 0 as the value of IsBreak, and I can't figure out why. The intention is of course to utilize this as a part of a more complicated search/alert. What am I doing wrong? Best regards, Petri
... View more