Can not searching by date in inputlookup es_notable_events

[Dmitriy]

Hi, please help to make search by date in inputlookup "es_notable_events". I thried to search by "earliest" its not work. 

[Dmitriy]

Thanks for help

[Dmitriy]

I found the way how to search

| inputlookup es_notable_events | eval last_modified_timestamp=_time
| eval myTime=relative_time(time(),"-1h")
| where last_modified_timestamp>myTime
| fields - time
|search rule_name="Threat Activity Detected"

[rupkumar4sec]

I don't think you can use earliest and latest in inputlookup. Try this

| where ( _time >= <earliest time> AND  _time <= <latest time>)