Hi,
I've a CSV imported data (hostname = AVGMAILCOUNT) and want to use its data based on present time values.
What I'm trying to do is searching that data according to current time parameters but i get error; (Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.)
I want search all data historially but for only same days (mondays for example)
Query gives above error;
host="AVGMAILCOUNT" date_wday = [ search eval A=strftime(now(),"%A") | return A]
Regards,
Hello
Use this subsearch instead:
host="AVGMAILCOUNT" date_wday = [|stats count | eval A=strftime(now(),"%A") | return $A]
regards
Hello
Use this subsearch instead:
host="AVGMAILCOUNT" date_wday = [|stats count | eval A=strftime(now(),"%A") | return $A]
regards