https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271429#M52117 <P>Calculate the age of the firstTime<BR /> Evaluate against 7d value<BR /> 7 days = 604800 seconds</P> <PRE><CODE>| metadata type=hosts index=_internal | eval age=now()-firstTime | where age&lt;604800 </CODE></PRE> Thu, 26 May 2016 21:57:06 GMT the_wolverine 2016-05-26T21:57:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271427#M52115 <P>I'm trying to use the <CODE>metadata</CODE> command to find hosts that have recently started sending logs. Basically when firstTime is more recent than 7 days. This is the search I have...</P> <PRE><CODE>| metadata type=hosts index=* | eval firstday=strftime(firstTime,"%Y-%m-%d") | where firstday&gt;=relative_time(now(),"-7d") </CODE></PRE> <P>I have tried many variations of this, to no avail. The 'firstday' field shows accurately, but the results are not filtered. Is there something I don't understand about this metadata command? I appreciate the help!</P> Thu, 26 May 2016 21:29:50 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271427#M52115 jbullough 2016-05-26T21:29:50Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271428#M52116 <P>firstTime is epoch<BR /> firstday is string<BR /> relative_time is epoch</P> <P>Simply do it this way:</P> <PRE><CODE> | metadata type=hosts index=* | where firstTime &gt;= relative_time(now(),"-7d") </CODE></PRE> Thu, 26 May 2016 21:55:17 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271428#M52116 javiergn 2016-05-26T21:55:17Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271429#M52117 <P>Calculate the age of the firstTime<BR /> Evaluate against 7d value<BR /> 7 days = 604800 seconds</P> <PRE><CODE>| metadata type=hosts index=_internal | eval age=now()-firstTime | where age&lt;604800 </CODE></PRE> Thu, 26 May 2016 21:57:06 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271429#M52117 the_wolverine 2016-05-26T21:57:06Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271430#M52118 <P>Wow, I was afraid it was something simple. This worked perfectly, thanks!!</P> Thu, 26 May 2016 22:30:41 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271430#M52118 jbullough 2016-05-26T22:30:41Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271431#M52119 <P>Actually this gave what appears to be more accurate results. I'll have to see why the other answer isn't giving exactly accurate results. Thanks!</P> Thu, 26 May 2016 22:33:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271431#M52119 jbullough 2016-05-26T22:33:55Z https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271432#M52120 <P>This looked right, but after trying the answer below the results are different, and it looks like it's producing more accurate results. I'll dig into why.</P> Thu, 26 May 2016 22:34:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-use-the-metadata-command-to-search-for-hosts-that-have/m-p/271432#M52120 jbullough 2016-05-26T22:34:37Z