How to chart with indexed time fields?

[dbturner]

I have a date field in this format Y-M-D. I want to chart everything that is two years older than that field. Not sure how to do that. I have look at many of the time related commands but can't think of how to apply them.

Thanks.

[woodcock · Accepted solution]

You can do it like this:

... | eval tnow = now()
| where ((firstSeen > relative_time(tnow, "-2y")) AND (firstSeen < realtive_time(tnow, "-1y")) AND (lastSeen > relative_time(tnow, "-30d")))

[somesoni2]

Can you post some sample events and expected output?

[dbturner]

Thanks for the reply, I ended up going a different route and using the original time format. Time format was in epoch and did the following statement to determine date ranges:

| eval tnow = now() | where firstSeen > (tnow-63072000) AND firstSeen < (tnow-31536000) AND lastSeen > (tnow-2592000)