I want to exclude duration results if greater than 7 days. So i used search NOT but it is not working.
Can someone help here?
Query
index=sentinelone | eval duration=tostring(now()-strptime(installedAt,"%Y-%m-%dT%H:%M:%S.%6N"),"duration") | table _time installedAt agentDomain duration |search installedAt!="Null"
Something like
index=sentinelone installedAt!="Null"
| eval duration=now()-strptime(installedAt,"%Y-%m-%dT%H:%M:%S.%6N")
| eval duration=if(duration < 7 * 86400, tostring(duration, "duration"), null())
| table _time installedAt agentDomain duration
Note your last search is based on a field that already exists in raw data. Moving it to the base search is more efficient.
Something like
index=sentinelone installedAt!="Null"
| eval duration=now()-strptime(installedAt,"%Y-%m-%dT%H:%M:%S.%6N")
| eval duration=if(duration < 7 * 86400, tostring(duration, "duration"), null())
| table _time installedAt agentDomain duration
Note your last search is based on a field that already exists in raw data. Moving it to the base search is more efficient.