Hi Community ,
I have a question about a conversion beetwen string to date.
I have some extract in CSV from my google platform like this :
> host=DSCRIPT02 sourcetype=csv:google | eval lastSync-mod=substr(lastSync,1,10) | search "lastSync-mod"!=Never AND "lastSync-mod"!=LastSync | table resourceId email lastSync-mod | sort lastSync-mod | head 20
I have the last 20 mobiles, but i want the the list of mobiles that was not sync until 30days. The problem is the field last-Sync-Mod is not recognized as a date format
Can you help me 🙂 ?
Many thanks
@serviceinfrastructure,
Try
"Your search "|eval last_sync_time=strptime(lastSync-mod,"%Y-%m-%d")|eval diff=(now()-last_sync_time)/86400|where diff>30