Hello everyone.
Want to display the output only for the time which crosses 18 months (earliest time)
Typed on a phone, so there may be errors, but would something like this work for you?
...|search QUEUE=message*
|eval level=case((QUEUE=MESSAGE1 AND QueueDepth>=400 AND MessageAge>=400), "high", (QUEUE=MESSAGE2 AND QueueDepth>=200 AND MessageAge>=300), "high", (QUEUE=MESSAGE3 AND QueueDepth>=100 AND MessageAge>=300), "high",1=1,"other")
|where level="high"
|stats count by QUEUE