It is not working, is there a typo in my query, I have removed the " in the subsearchto make the output boolean.
I am getting the response even when the run day is not Last working day of the month, it is not taking the gentimes subsearch result as condition to process the search part after fist | .
index=MyIndex queryType="ts" filename=Pharmacy*.JSON [| gentimes start=-1 | eval lastDOM=relative_time(now(),"+1mon@mon-1d") | eval lastWDOM=case(strftime(lastDOM,"%a")="Sun", relative_time(lastDOM,"-2d@d"),strftime(lastDOM,"%a")="Sat", relative_time(lastDOM,"-1d@d"),1=1,lastDOM) | eval query=if(relative_time(now(),"@d")=lastWDOM,1=1,1=2) | table query] | table _time,accountName,filename,filesize
... View more