I try this solution but isn't work too but more easier to debugg I think. Can you tell me why DateAffect is not convert ?
And why this where block again the result ?
index="aaa"
| rename "logs{}.*" as *
|fields user.lastName,projectId,user.firstName, user.lastName,time,type,date
| eval acteur='user.firstName'." ".'user.lastName'
| search acteur="XXX"
| rename projectId as NOVA_ID
| join[ search index="gtav2_projects" projects{}.icma="*"
| rename projects{}.id as NOVA_ID, projects{}.icma as ICMA ]
| rename projects{}.title as Title ,projects{}.client.name as "Nom Client"
| dedup Title| convert timeformat="%d/ %m/ %Y" ctime(date) as DateAffect
| eval debut=relative_time(now(),"-7mon")
| convert timeformat="%d/ %m/ %Y %H:%M" ctime(debut)
| eval fin=relative_time(now(),"-1d")
| convert timeformat="%d/ %m/ %Y %H:%M" ctime(fin)
| where (DateAffect > debut AND DateAffect < fin )
|table "Nom Client",Title,ICMA,debut,fin,date,DateAffect
Thanks for your answer.
... View more