I have a date field in this format Y-M-D. I want to chart everything that is two years older than that field. Not sure how to do that. I have look at many of the time related commands but can't think of how to apply them.
Thanks.
You can do it like this:
... | eval tnow = now()
| where ((firstSeen > relative_time(tnow, "-2y")) AND (firstSeen < realtive_time(tnow, "-1y")) AND (lastSeen > relative_time(tnow, "-30d")))
You can do it like this:
... | eval tnow = now()
| where ((firstSeen > relative_time(tnow, "-2y")) AND (firstSeen < realtive_time(tnow, "-1y")) AND (lastSeen > relative_time(tnow, "-30d")))
Can you post some sample events and expected output?
Thanks for the reply, I ended up going a different route and using the original time format. Time format was in epoch and did the following statement to determine date ranges:
| eval tnow = now() | where firstSeen > (tnow-63072000) AND firstSeen < (tnow-31536000) AND lastSeen > (tnow-2592000)