Having issues with latest and earliest time in search

[srinivas_gowda]

Hello all,

I am trying to run the below query and when I change the earliest to last 7 days I am getting the below error. However, it is running fine if I add -30d for earliest search.

`acn_patchmanagement_macro_serverdetails_t1_001`
|where NOT IN (Server,[|search earliest=-7d latest=now() `acn_patchmanagement_macro_serverdetails_t1_001` |stats count(Server) by Server|table Server])
|lookup acn_patchmanagement_lookup_server-details_001 Server OUTPUT OS_Type OS_SubType
| eval OS_Type=if(isnull(OS_Type), "NA", OS_Type)
| eval OS_SubType=if(isnull(OS_SubType), "NA", OS_SubType)
|append [| inputlookup acn_patchmanagement_lookup_server-details_001.csv ]
|fields Last_Patched_Date ChangeNo Server OS_Type OS_SubType Overall_Status

 Below is the error:

Error in 'where' command: The expression is malformed. An unexpected character is reached at ') ) '.

Please let me know the solution for this.

[ITWhisperer]

Try return $Server at the end of the subsearch

[aasabatini]

Hi @srinivas_gowda 

try to change where with search

|search NOT IN (Server,[|search earliest=-7d latest=now()

[srinivas_gowda]

Hello, Thank you for your response.

I tried and now facing the issue with the NOT IN. Below is the error.

Error in 'search' command: Unable to parse the search: Comparator 'IN' has an invalid term on the left hand side: NOT.

[aasabatini · Accepted solution]

Hi @srinivas_gowda 

yes, make sense

Try this

|search NOT (Server,[|search earliest=-7d latest=now() `acn_patchmanagement_macro_serverdetails_t1_001` |stats count(Server) by Server|table Server])

[srinivas_gowda]

This worked. Thank you.