I'm trying to sort smartsheets by certain combinations of row/column values. If I remove one of the 'foreach' blocks, the search works, outputting a new field. With both, however, the search returns 0 results. I'm wondering if there's a better way to do this.
Also, the reason I can't just eval them separately is that one of the fields (a column) "Final" appears both in "Project scheduling" row events and "Project closed" row events
index=main sourcetype=smartsheet
| rename metadata.smartsheet_name as sheetname
| dedup metadata.id
| foreach sheetname
[ search "Task Name"="Project scheduling"
| eval nowtime=strftime(now(), "%Y-%m-%d")
| eval nowtime=strptime(nowtime, "%Y-%m-%d")
| eval scheduledtime=strptime(Finish,"%Y-%m-%d")
| eval scheduledOk=if(scheduledtime<=nowtime, "true", "false")]
| foreach sheetname
[ search "Task Name"="Project closed"
| eval nowtime=strftime(now(), "%Y-%m-%d")
| eval nowtime=strptime(nowtime, "%Y-%m-%d")
| eval finishtime=strptime(Finish,"%Y-%m-%d")
| eval finishedOk=if(finishtime>nowtime, "true", "false")]
... View more