I tried but unable to use _time as the field shows blank and I had to convert my Inputlook fields which has time string and use. i got stuck here at the moment. Thank you
| inputlookup test
| fields Category,Time
| eval Time= strptime(Time, "%Y-%m-%d %H:%M:%S")
| where Time>=relative_time(now(),"-1d")
| eval c_time=strftime(Time,"%F %T")
Category Time c_time
1 APPLE 1526434675.000000 2018-05-16 11:37:55
2 APPLE 1526451005.000000 2018-05-16 16:10:05
3 APPLE 1526448470.000000 2018-05-16 15:27:50
4 Banana 1526466669.000000 2018-05-16 20:31:09
5 Mango 1526438117.000000 2018-05-16 12:35:17
6 Mango 1526443223.000000 2018-05-16 14:00:23
... View more