I have created a csv file with dates of federal holidays.
holiday_date
01/01/19
01/21/19
I am trying to run my search like below.
index=appxindex |eval today_date=strftime(_time,"%m/%d/%y") | search NOT [|inputlookup exclude_holidays.csv holiday_date as today_date ]
The above is not working. All I want to do is if today_date = holiday_date (in csv file), I do not want to search. Any ideas?
@gnshah12345 ,
inputlookup
doesnt have AS
clause.
Try
index=appxindex |eval holiday_date=strftime(_time,"%m/%d/%y")
| search NOT [|inputlookup exclude_holidays.csv|fields holiday_date]
OR
index=appxindex |eval today_date=strftime(_time,"%m/%d/%y")
| search NOT [|inputlookup exclude_holidays.csv|rename holiday_date as today_date ]