index=myindex
| eval createdepoch = strptime(created, "%Y-%m-%d")
| eval _time = createdepoch
| search earliest=-90d@d
| table _time
This returns no results, Can anyone tell me why this wouldn't work?
The time range filters (earliest/latest/_index_earliest/_index_latest etc) work on base search (portion before first pipe, for both main search and subsearch) only. Unless there is a field called "earliest" returned by your base search, your query will always fail.
Assuming you want to filter result based on newly calculated _time field, try something like this:
index=myindex
| eval createdepoch = strptime(created, "%Y-%m-%d")
| eval _time = createdepoch
| where _time>=relative_time(now(),"-90d@d")
| table _time