Hi all Splunker!
I'm actually dealing with a Dashboard problem and i need your help.
In particular, i call an **inputlookup** command which filename need to be a variable related to today day.
The normal command not parametrized work as expected, and following is the code:
***|join type=left "Field A"
|inputlookup 3831_Des2_2019_11_21.csv | fields Field A, Field B***
Now, i need to parametrize the final part of filename, due to i need this search every day.
And i replace the previous code with:
*** |join type=left "Field A"
|inputlookup
[stats count |
eval today ........
eval day........
eval month........
eval year .........
eval filename= "3831_Des2_20".year."_".month."_".day.".csv"
|return $filename ]
| fields Field A, Field B***
I see the filename is correctly derived, but in the join there is always one same result recurring for all events.
I have also tried with |makeresults command, but nothing.
Any kindly suggestion?
Luca
↧