How do I set a new field as a source of time?

[zhatsispgx]

After I have converted epoch time in first_seen to the format in c_time, how do i set c_time as my source of time? My end goal is to make the search below give me results where c_time is older than 7 days. (The data set is from a dbconnect batch import, so i cannot use _time)

index=main source=dns_zones sourcetype=inventory ip!=10.0.0.0/8 AND ip!=192.168.0.0/16 | 
dedup subdomain | 
eval c_time=strftime(first_seen,"%m/%d/%y %H:%M:%S") | 
search c_time >= now() - 7d | 
sort by -first_seen | 
table domain,subdomain,ip,c_time

[sundareshr]

Try this

 index=main source=dns_zones sourcetype=inventory ip!=10.0.0.0/8 AND ip!=192.168.0.0/16 | 
 dedup subdomain | 
 eval c_time=strptime(first_seen,"%m/%d/%y %H:%M:%S") | 
 where c_time <= relative_time(now(), "-7d") | 
 sort by -first_seen | 
 table domain, subdomain, ip, first_seen c_time