Can someone help me break down this portion of a search?
Is it saying, look for anything older than 30 minutes?
eval recent = if(latest > relative_time(now(),"-30m"),1,0), realLatest = strftime(latest,"%c") | where recent=0
Newer timestamps are bigger than older timestamps so (latest > relative_time(now(),"-30m") looks for events with a 'latest' field value in the last 30 minutes.
Newer timestamps are bigger than older timestamps so (latest > relative_time(now(),"-30m") looks for events with a 'latest' field value in the last 30 minutes.