I have the start of a query but I can't get it to limit a look up by time. I need to use the converted field sent_time as the timestamp to base the look back on. Any suggestions as to what I can do to improve this query? I tried to subtract 3 months worth of seconds from the epoch time number, not sure if that logic is appropriate.
sourcetype="log_file" | eval sent_date=strptime(mail_date,"%d %b %Y") | sent_date>(sent_date-7948797) | dedup mail_date | table name, id, mail_date, sent_date | sort sent_date
sourcetype = log_file | eval sent_date = strptime (mail_date, "%d %b %Y" ) |
where sent_date >= relative_time(_time, -30d)
Try this!