index=product_iround_prod Level=INFO Message="Form Synchronizer complete" | stats latest(_time) AS timestamp, latest(RecordsProcessed) AS RecordCount by ProfileName FormName | convert ctime(timestamp) | sort timestamp asc
how do I filter this down to where the latest is older than say 15 minutes ago ?
Hi leonardr,
Try this
.. | eval mins_back = relative_time(now(), "-15m@m") | where timestamp >= mins_back
| convert ctime(timestamp) | sort timestamp asc
Note that timestamp value must still be in epoch time (matching mins_back) for the where to work. Also the where is greater than equal so maybe not exactly what you want. If you want to match a time string exactly then this can get a bit more tricky. Maybe provide some examples if you need more help.
Hi leonardr,
Try this
.. | eval mins_back = relative_time(now(), "-15m@m") | where timestamp >= mins_back
| convert ctime(timestamp) | sort timestamp asc
Note that timestamp value must still be in epoch time (matching mins_back) for the where to work. Also the where is greater than equal so maybe not exactly what you want. If you want to match a time string exactly then this can get a bit more tricky. Maybe provide some examples if you need more help.
Awesome thank you !