How to adjust the search time partly based on the time picker?

[samlinsongguo]

HI Guys
I am doing a report for my ticketing system. there is a field call open_time which indicate when is the ticket open, and each time the ticket got an update, there will be a log entry. If I want to create a report that shows ticket opened in last 7 days I will need to exclude the log message relate with a ticket that opened before 7 days but has an update in the last 7 days. I tried following code it works

| eval 7daysago=now()-604800
| where opentime>7daysago

The limit on this is if you want to run a report for last 30 days, then I have to change the number to 2592000 in the SPL which is not very flexible. I am just wondering if there is a better way to do it.

Thx

[somesoni2 · Accepted solution]

So, you basically you want to exclude all events where field opentime (has value in epoch) older than selected time range (last 7 day or last 30 day or whatever). So something like this

your current search 
| addinfo
| rename COMMENT as "The addinfo command will add search's timerange to search result. field info_min_time is earliest and info_max_time is latest"
| where opentime>=info_min_time | fields - info_*_time info_sid

[samlinsongguo]

yea that works
Thank you for your help it is very good

[niketn]

@samlinsongguo can you add a sample event data of the exact date format for open_time field?