I want the table to be generated based on 2 conditions - one condition is comparing eval expression and other field value pair.. how to do that
index="myindex" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) AND ('System Status'!="Completed")
This where clause is not working.. please help
i dont have logs to test this, can you check this once -
index="myindex" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) | search 'System Status'!="Completed"
or even, you can try checking the System Status at first stage itself -
index="myindex" 'System Status'!="Completed" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time)
I can see two issues:
1) Your "|table ID,Category" is getting rid of some fields you are using later on such as now_time, System Status or Due_Date_Time.
2) I think this part is also going to cause you a headache as you are not comparing integers with integers, just strings with strings:
where (now_time>=Due_Date_Time)
Can you try this instead?
index="myindex"
|eval Due_Date_Epoch = strptime('Due By',"%d.%m.%Y")
|table ID, Category, Due_Date_Epoch, 'System Status'
| where (now() >= Due_Date_Epoch) AND ('System Status'!="Completed")
Thanks,
J
Thanks for your reply. This is also not working..
i dont have logs to test this, can you check this once -
index="myindex" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time) | search 'System Status'!="Completed"
or even, you can try checking the System Status at first stage itself -
index="myindex" 'System Status'!="Completed" |eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category | where (now_time>=Due_Date_Time)
Thanks for your reply.. both are not working
second one works till here.. where clause time condition not working 😞
index="myindex" "System Status"!="Completed"|eval Due_Date_Time = strftime(strptime('Due By',"%d.%m.%Y"),"%d.%m.%Y")|eval now_time=strftime(now(),"%d.%m.%Y")|table ID,Category
index="myindex" 'System Status'!="Completed"
|eval Due_Date = strptime('Due By',"%d.%m.%Y")
| where (now() >= Due_Date)
|table ID, Category
It worked the way i wanted.. Thank you so much..