How to write a look back query with epoch time?

[kiersti]

I have the start of a query but I can't get it to limit a look up by time. I need to use the converted field sent_time as the timestamp to base the look back on. Any suggestions as to what I can do to improve this query? I tried to subtract 3 months worth of seconds from the epoch time number, not sure if that logic is appropriate.

sourcetype="log_file" | eval sent_date=strptime(mail_date,"%d %b %Y") |  sent_date>(sent_date-7948797) | dedup mail_date | table name, id, mail_date, sent_date | sort sent_date

[lguinn2]

sourcetype = log_file | eval sent_date = strptime (mail_date, "%d %b %Y" ) |
where sent_date >= relative_time(_time, -30d)

Try this!