HI Guys
I am doing a report for my ticketing system. there is a field call open_time which indicate when is the ticket open, and each time the ticket got an update, there will be a log entry. If I want to create a report that shows ticket opened in last 7 days I will need to exclude the log message relate with a ticket that opened before 7 days but has an update in the last 7 days. I tried following code it works
| eval 7daysago=now()-604800
| where opentime>7daysago
The limit on this is if you want to run a report for last 30 days, then I have to change the number to 2592000 in the SPL which is not very flexible. I am just wondering if there is a better way to do it.
Thx
So, you basically you want to exclude all events where field opentime
(has value in epoch) older than selected time range (last 7 day or last 30 day or whatever). So something like this
your current search
| addinfo
| rename COMMENT as "The addinfo command will add search's timerange to search result. field info_min_time is earliest and info_max_time is latest"
| where opentime>=info_min_time | fields - info_*_time info_sid
So, you basically you want to exclude all events where field opentime
(has value in epoch) older than selected time range (last 7 day or last 30 day or whatever). So something like this
your current search
| addinfo
| rename COMMENT as "The addinfo command will add search's timerange to search result. field info_min_time is earliest and info_max_time is latest"
| where opentime>=info_min_time | fields - info_*_time info_sid
yea that works
Thank you for your help it is very good
@samlinsongguo can you add a sample event data of the exact date format for open_time
field?