Filtering out one field by time in a search

[iiRajMahalii]

I have a lookup table with a few fields (FirstSeenDate, LastSeenDate, IP, etc...). I have a search created to show me the top 10 events in the table by count. What I want to do is add a part in the search to filter out anything that is older than 90 days in the FirstSeenDate column. 

[richgalloway · Accepted solution]

To filter out events where FirstSeenDate is older than 10 days, insert this early in your query

| where strptime(FirstSeenDate, "%Y-%m-%d %H:%M:%S") < relative_time(now(), "-90d")

[iiRajMahalii]

Thank you! That did the trick. I added this to the string right after the lookup.csv is being called. 

[iiRajMahalii]

So far I just have it being listed as top 10 from the list. 

| stats count by dest_ip
| sort -count
| head 10
| rename dest_ip as LIST, count as "Events" | table LIST, "Events"
| lookup Lookup.csv LIST OUTPUT FirstSeenDate,LastSeenDate,TotalSeenCount
|rename LIST as "IP"| table "IP", "Events", FirstSeenDate,LastSeenDate,TotalSeenCount

The format of the FirstSeenDate is YYYY-mm-dd  HH:MM:SS

I want to have the results give me the top 10 events by count which it already does but also filter the FirstSeenDate as only list  the top 10 events from the last 3 months.

Thank you

[richgalloway]

That shouldn't be too difficult.  What have you tried so far?  What is the format of the FirstSeenDate field?