I have a search that makes a decision based on time since an event.
| eval diff = now() - _time
and then make some decision based on how long ago the event took place
| eval state = if(diff<300, "active", "not active")
However, if I want to run this historically, my diffs are set to current time so I can't easily look historically at a point in time and tell the state of the world (with the same search).
Is there a time function in search where I can pull the earliest and latest time filters?
| eval diff = $timerange.latest$ - _time
| eval diff = info_max_time - _time
View solution in original post