Remember, search is used to compare fields to literals whereas where is used to compare fields to fields or expressions. Sometimes both work. Sometimes not. | search Time_MS>0 | where isnotnull(Time_MS)   ... View more

You want to use the delta search command. First, invert the sort order otherwise your maintenance mode entry will have nothing against which it can compare. This assumes the dates in epoch time as your example suggests. Then,  use the delta command a=on the date field. Remember, because you inverted the order these numbers will now be negative. Finally, search for anything older than 2 days (86400s * 2) and not 0.  Here's a straw man search: | index=<your_index> sourcetype=<your_sourcetype> | sort - date | delta date AS date_diff | search date_diff < 172800 AND date_diff != 0   ... View more