Hi experts,
Search 1:
base search from JSON...
| eval col1=strptime(taken_date,"%b %d %Y %H:%M:%S")
| stats latest(col1) as max_col
The above search returns a single value.
Based on the single value max_col
, i would like to run the below search which displays the
values of col1
only when col1 > (max_col-2629743)
.
Search 2:
base search from JSON...
| eval col1=strptime(taken_date,"%b %d %Y %H:%M:%S")
| eval max_col1_30= max_col-2629743
| where col1 > max_col1_30
| table col1 max_col1_30
Could you please help by joining both the searches?
Sub search is not working for me.
Thank you.
use eventstats
instead of stats