This is the query that i used, it is returning no results index=tenable* sourcetype="*" | where pluginID <1000000 | eval firstSeen=strftime(firstSeen, "%m/%d/%Y %H:%M:%S") | eval lastSeen=strftime(lastSeen, "%m/%d/%Y %H:%M:%S") | eval discovery = strptime(lastSeen, "%m/%d/%Y %H:%M:%S") - strptime(firstSeen, "%m/%d/%Y %H:%M:%S") | eval Age = round(discovery / 86400, 2) | eval firstSeen =strftime(strptime(firstSeen,"%m/%d/%Y %H:%M:%S"),"%d-%B-%y") | eval lastSeen =strftime(strptime(lastSeen,"%m/%d/%Y %H:%M:%S"),"%d-%B-%y") | dedup pluginID | where firstSeen>now()-7*86400 | table State Age dnsName firstSeen ip lastSeen severity pluginID
... View more