Can you help me with my string to date query?

[serviceinfrastr]

Hi Community ,

I have a question about a conversion beetwen string to date.

I have some extract in CSV from my google platform like this :

> host=DSCRIPT02 sourcetype=csv:google | eval lastSync-mod=substr(lastSync,1,10)  | search "lastSync-mod"!=Never AND  "lastSync-mod"!=LastSync | table  resourceId email lastSync-mod | sort lastSync-mod | head 20

I have the last 20 mobiles, but i want the the list of mobiles that was not sync until 30days. The problem is the field last-Sync-Mod is not recognized as a date format

Can you help me 🙂 ?

Many thanks

[renjith_nair]

@serviceinfrastructure,

Try

"Your search "|eval last_sync_time=strptime(lastSync-mod,"%Y-%m-%d")|eval diff=(now()-last_sync_time)/86400|where diff>30