How to use a date field in my data to filter and only return search results within a certain time range?

[danderson_splun]

I have a field of lastConnected that I want to evaluate as containing a date in the last 7 days and then pipe that sub-set of results to a dedup on a different field (guid). How can I do this?

[sundareshr]

Try this

.... | eval lastWeek=relative_time(now(), "-7d@d") | where lastConnected>lastWeek | dedup guid

OR, instead of deduping on guid, you could do

.... | eval lastWeek=relative_time(now(), "-7d@d") | where lastConnected>lastWeek | stats <<count and/or other functions>> by guid

Dedup is an expensive operation and should be avoided if possible.