How to exclude results in search?

[alexspunkshell]

I want to exclude duration results if greater than 7 days. So i used search NOT but it is not working.

Can someone help here?

Query

index=sentinelone | eval duration=tostring(now()-strptime(installedAt,"%Y-%m-%dT%H:%M:%S.%6N"),"duration") | table _time installedAt agentDomain duration |search installedAt!="Null"

[yuanliu · Accepted solution]

Something like 

index=sentinelone installedAt!="Null"
| eval duration=now()-strptime(installedAt,"%Y-%m-%dT%H:%M:%S.%6N")
| eval duration=if(duration < 7 * 86400, tostring(duration, "duration"), null())
| table _time installedAt agentDomain duration

Note your last search is based on a field that already exists in raw data.  Moving it to the base search is more efficient.