Limit timechart from lookup table

[humanBeing]

Hello all,

I'm using a lookup table with a _time field to create a timechart which works great.  

However, the lookup table has data for say 90 days and I don't always want the timechart to be for the full 90 days.  

How can I limit my timechart to 30 days from my lookup table that has 90 days worth of data without deleting the extra 60 days?  

The _time field is in already in the format %y-%m-%d %H:%M

I've tried 
|inputlookup mylookupfile where earliest=-30d

Thank you!

[richgalloway · Accepted solution]

The queries allowed in the where clause of inputlookup are different from those allowed in the search command.  In particular, "earliest" in search maps to the _time field whereas in inputlookup it refers to the "earliest" field.

A further complication is inputlookup where does not recognize time modifiers.

One workaround is to read the entire lookup, convert _time to epoch form, then compare the converted time to the timestamp 30 days old.

| inputlokoup mylookup
| eval eTime=strptime(_time, "%Y-%m-%d %H:%%M")
| where eTime > relative_time(now(), "-30d")
| fields - eTime