Does the `p_occurs` macro use `p_parse_time` in the Panther Data Explorer?
Last updated: September 3, 2024
QUESTION
Does the p_occurs macro use p_parse_time?
ANSWER
No, as per our documentation, the p_occurs macro uses p_event_time by default. However, if you would like the p_occurs macro to use p_parse_time, you can format your query like this:
p_occurs_since('1 day',,p_parse_time)