How to count matching events in lookup in last 30 days?

[Sven1]

A have a lookup table that includes a "time" column (timeformat=%m/%d/%Y %H:%M:%S). Can someone please help me develop a search that counts the number of dates within that column that are within the last 30 days?

Thank you in advance. 

Sven

[ITWhisperer]

You need to parse the time field into an epoch time with strptime(); you can then use the epoch time for comparisons and calculations

| eval epochtime=strptime(time,"%m/%d/%Y %H:%M:%S")

| where epochtime > relative_time(now(),"30d")

[Sven1]

ITWhisperer - Thank you!  

Can you please tell me also how I can do the same search, except the "time" column fields are in epoch time?  In other words, how would I revise the below search?

| inputlookup append=T lookup_march
| where time > relative_time(now(),"30d")
| stats count as total

[ITWhisperer · Accepted solution]

Sorry, I missed out a minus

| inputlookup append=T lookup_march
| where time > relative_time(now(),"-30d")
| stats count as total

[Sven1]

Thank you ITWhisperer.  I noticed that it might just need a minus sign, but did fully pursue. 

I appreciate your help.