How to use the metadata command to search for hosts that have recently started sending data to Splunk?

[jbullough]

I'm trying to use the metadata command to find hosts that have recently started sending logs. Basically when firstTime is more recent than 7 days. This is the search I have...

| metadata type=hosts index=* | eval firstday=strftime(firstTime,"%Y-%m-%d") | where firstday>=relative_time(now(),"-7d")

I have tried many variations of this, to no avail. The 'firstday' field shows accurately, but the results are not filtered. Is there something I don't understand about this metadata command? I appreciate the help!

[the_wolverine · Accepted solution]

Calculate the age of the firstTime
Evaluate against 7d value
7 days = 604800 seconds

| metadata type=hosts index=_internal | eval age=now()-firstTime | where age<604800

[jbullough]

Actually this gave what appears to be more accurate results. I'll have to see why the other answer isn't giving exactly accurate results. Thanks!

[javiergn]

firstTime is epoch
firstday is string
relative_time is epoch

Simply do it this way:

 | metadata type=hosts index=* | where firstTime >= relative_time(now(),"-7d")

[jbullough]

Wow, I was afraid it was something simple. This worked perfectly, thanks!!

[jbullough]

This looked right, but after trying the answer below the results are different, and it looks like it's producing more accurate results. I'll dig into why.