Hello everyone.
Want to display the output only for the time which crosses 18 months (earliest time)
Please try something like.. (would be good if paste some sample events , so we can frame the query)
|inputlookup Qasd.csv
|stats latest(alpq) as latest_time first(alpq) as earliest_time by Release
| eval earliest_time=strftime(earliest_time,"%d/%m/%Y")
| eval latest_time =strftime(latest_time,"%d/%m/%Y")