After I have converted epoch time in first_seen
to the format in c_time
, how do i set c_time
as my source of time? My end goal is to make the search below give me results where c_time is older than 7 days. (The data set is from a dbconnect batch import, so i cannot use _time
)
index=main source=dns_zones sourcetype=inventory ip!=10.0.0.0/8 AND ip!=192.168.0.0/16 |
dedup subdomain |
eval c_time=strftime(first_seen,"%m/%d/%y %H:%M:%S") |
search c_time >= now() - 7d |
sort by -first_seen |
table domain,subdomain,ip,c_time
Try this
index=main source=dns_zones sourcetype=inventory ip!=10.0.0.0/8 AND ip!=192.168.0.0/16 |
dedup subdomain |
eval c_time=strptime(first_seen,"%m/%d/%y %H:%M:%S") |
where c_time <= relative_time(now(), "-7d") |
sort by -first_seen |
table domain, subdomain, ip, first_seen c_time