I have a field of lastConnected that I want to evaluate as containing a date in the last 7 days and then pipe that sub-set of results to a dedup on a different field (guid). How can I do this?
Try this
.... | eval lastWeek=relative_time(now(), "-7d@d") | where lastConnected>lastWeek | dedup guid
OR, instead of deduping on guid, you could do
.... | eval lastWeek=relative_time(now(), "-7d@d") | where lastConnected>lastWeek | stats <<count and/or other functions>> by guid
Dedup is an expensive operation and should be avoided if possible.