Hello I have a search that I use to calculate days between 2 dates.
The search is like this:
|index=dev_tsv "BO Type"="assessments" | rename "BO ID" as id| convert timeformat="%Y-%m-%d %H:%M:%S.%6N" mktime("Step Date Started") AS starttime mktime("Step Date Completed") AS endtime mktime("Step Due Date") AS cumulativeDueDate mktime("Step Actual Due Date") AS actualDueDate
|eval dueDateRange=mvrange(cumulativeDueDate,now(),86400)
|convert ctime(dueDateRange) timeformat="%+"
| eval pastDueDays =mvcount(mvfilter(NOT match(dueDateRange,"(Sun|Sat).*")))
| mvexpand pastDueDays | search NOT [| inputlookup exclude_holidays | eval holiday_date=strptime(holiday_date, "%Y-%m-%d %H:%M:%S") | rename holiday_date as pastDueDays ]
|eval pastDueDays=if(isnull(pastDueDays),"0", pastDueDays)
|dedup "Workflow Name" "Workflow Phase" "Workflow Process Due Date" "Workflow Process Name" "Workflow Process Sort Order" "Workflow Started Date" "Workflow Step Name" "Step Due Date" "Workflow Step Sort Order"
| table "Workflow Name" "Workflow Phase" "Workflow Process Due Date" "Workflow Process Name" "Workflow Process Sort Order" "Workflow Started Date" "Workflow Step Name" "Step Due Date" "Workflow Step Sort Order" pastDueDays
Right now it works but does not exclude the exclude_holiday dates from the lookup it just excludes weekends.
The csfv is simply holiday_date like:
holiday_date
2018-01-01 00:00:00
2018-01-15 00:00:00
2018-02-19 00:00:00
2018-05-28 00:00:00
2018-07-04 00:00:00
2018-09-03 00:00:00
2018-10-08 00:00:00
2018-11-12 00:00:00
2018-11-22 00:00:00
2018-12-25 00:00:00
Any ideas what would be preventing me from being able to use the lookup and exclude those dates?
↧