Thank you for the response. I also found another way to do this. Here is the solution I used:
I use strptime to convert Close_Date to epoc time. [ ...| eval CD=strptime(Close_Date, "%Y-%m-%d %H:%M:%S") | ... ]
I then use relative_time to calculate the epoc time of my benchmarks, 30 days, 60 days, and 90 days ago. [ ... | eval days30=relative_time(now(),"-30d@d") | eval days60=relative_time(now(),"-60d@d") | eval days90=relative_time(now(),"-90d@d") | ... ]
Use a nested if statement to calculate which window each event falls into. [ ... | eval Age=if(CDdays90,60,if(CDdays60,30,0))) | ... ]
Get rid of the events that were closed in the last 30 days (different than my initial question... I know..). [ ... | where Age>1 | ... ]
Display the results using stats. [ ... | stats count by Age ]
So, putting it all together:
::my search here:: | eval CD=strptime(Close_Date, "%Y-%m-%d %H:%M:%S") | eval days30=relative_time(now(),"-30d@d") | eval days60=relative_time(now(),"-60d@d") | eval days90=relative_time(now(),"-90d@d") | eval Age=if(CD<days90,90,if(CD<days60 AND CD>days90,60,if(CD<days30 AND CD>days60,30,0))) | where Age>1 | stats count by Age
... View more