Convert a time field and use that time to search

[FraserC1]

Hi,

I have a search which returns a filed name: create_time and the results are like this: 

2020-08-11T17:10:00+0000

What I want to do is this search:

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d
| dedup server_name name

But use the time in create_time as the basis for the earliest=-1d search. Is this sort of thing possible?

Cheers.

[richgalloway]

The earliest keyword applies only to the _time field.  To filter on create_time, use a separate command after converting the field to epoch form.

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d
| eval created = strptime(create_time, "%Y-%m-%dT%H:%M:%S%z")
| where created > relative_time(now(), "-1d")
| dedup server_name name

[to4kawa]

index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" 
[search index="automox" sourcetype="automox:software" severity=critical installed=true os_name="Server*" earliest=-1d | dedup server_name name | eval creation_time=strptime(creation_time,"%FT%T%z") | eval earliest=relative_time(creation_time,"-1d") | stats min(earliest) as earliest]

[FraserC1]

Hey thanks for looking at this for me. I ran this search and it returns zero results.
I am unclear what the purpose of the subsearch is here.