I'm using the following to eval current_day:
| inputlookup Files_And_Thresholds
| eval current_day=lower(strftime(relative_time(now(),"@s"),"%A"))
I have a column in a lookup file (.csv) with days '"file_days" I would like to search across, I can not figure out why this will not search? If I replace current_day with the string "tuesday" it works fine?
| makemv delim=" " file_days
| search file_days=current_day
lookup table:
file_cutoff_time file_days file_name
23:00:00 thursday wednesday FILE001.CSV
22:00:00 friday monday thursday tuesday wednesday FILE002.CSV
Try this.
| inputlookup lookup.csv | eval current_day=lower(strftime(relative_time(now(),"@s"),"%A")) | where like(file_days,"%".current_day."%")
I have assumed below csv file.
file_cutoff_time,file_days,file_name
23:00:00,thursday wednesday,FILE001.CSV
22:00:00,friday monday thursday tuesday wednesday,FILE002.CSV
KV
Try this.
| inputlookup lookup.csv | eval current_day=lower(strftime(relative_time(now(),"@s"),"%A")) | where like(file_days,"%".current_day."%")
I have assumed below csv file.
file_cutoff_time,file_days,file_name
23:00:00,thursday wednesday,FILE001.CSV
22:00:00,friday monday thursday tuesday wednesday,FILE002.CSV
KV
space separated.