how i can use timeformat.

[rajhemant26]

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

[koshyk]

Please try something like.. (would be good if paste some sample events , so we can frame the query)

|inputlookup Qasd.csv 
|stats latest(alpq) as latest_time first(alpq) as earliest_time by Release 
| eval earliest_time=strftime(earliest_time,"%d/%m/%Y")
| eval latest_time =strftime(latest_time,"%d/%m/%Y")