I have a string field (publicationdate) that is displaying a date in the following format YYYY/mm/dd. Ultimately I would like to display in a dashboard any logs displaying a publicationdate within the last 7 days.
I suspect I am having trouble because it is a sting field and not numeric but have been unsuccessful in finding the correct syntax.
In general, you want the
strptime() function to change the display format into epoch time format, and
strftime() to go the other way.
However, in this case, because the ISO format you showed will sort dates into the same order, you can just change current date - 7 days into the same format and compare directly.
| eval testDate = strftime(now()-7*24*3600,"%Y/%m/%d") | where publication_date >= testDate
> if you want to exclude the date one week ago (ie exclude last Friday if today is Friday).