Hi, please help to make search by date in inputlookup "es_notable_events". I thried to search by "earliest" its not work.
Thanks for help
I found the way how to search
| inputlookup es_notable_events | eval last_modified_timestamp=_time| eval myTime=relative_time(time(),"-1h")| where last_modified_timestamp>myTime| fields - time|search rule_name="Threat Activity Detected"
I don't think you can use earliest and latest in inputlookup. Try this
| where ( _time >= <earliest time> AND _time <= <latest time>)