https://community.splunk.com/t5/Splunk-Search/Display-Dates-that-Expire-in-90-days/m-p/485702#M135904 <P>Hello, </P> <P>We have a field called "Certificate Expiration Date" and trying to only show items that expire 90 days or less. Have tried fieldformat with no luck.</P> <P>Suggestions?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7710i2CFD94B35A3AB164/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 24 Sep 2019 19:48:31 GMT jordanking1992 2019-09-24T19:48:31Z https://community.splunk.com/t5/Splunk-Search/Display-Dates-that-Expire-in-90-days/m-p/485702#M135904 <P>Hello, </P> <P>We have a field called "Certificate Expiration Date" and trying to only show items that expire 90 days or less. Have tried fieldformat with no luck.</P> <P>Suggestions?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7710i2CFD94B35A3AB164/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 24 Sep 2019 19:48:31 GMT https://community.splunk.com/t5/Splunk-Search/Display-Dates-that-Expire-in-90-days/m-p/485702#M135904 jordanking1992 2019-09-24T19:48:31Z https://community.splunk.com/t5/Splunk-Search/Display-Dates-that-Expire-in-90-days/m-p/485703#M135905 <P>Greetings @jordanking1992,</P> <P>Here's a run-anywhere example:</P> <PRE><CODE> | makeresults | eval CertificateExpirationDate = "9/24/2018 10:00 PM" | append [ | makeresults | eval CertificateExpirationDate = "9/24/2019 10:00 PM" ] | append [ | makeresults | eval CertificateExpirationDate = "12/20/2019 10:00 PM" ] | append [ | makeresults | eval CertificateExpirationDate = "1/10/2020 10:00 PM" ] | append [ | makeresults | eval CertificateExpirationDate = "9/24/2020 10:00 PM" ] | eval CertificateExpirationDate_epoch = strptime(CertificateExpirationDate, "%m/%d/%Y %I:%M %p") | where CertificateExpirationDate_epoch &lt; (now() + 90*86400) AND CertificateExpirationDate_epoch &gt; now() | fields - CertificateExpirationDate_epoch </CODE></PRE> <P>For your data, it will look more like this:</P> <PRE><CODE>[your base search] | eval CertificateExpirationDate_epoch = strptime('Certificate Expiration Date', "%m/%d/%Y %I:%M %p") | where CertificateExpirationDate_epoch &lt; (now() + 90*86400) | fields - CertificateExpirationDate_epoch </CODE></PRE> <P>If you only want values in the future, add another check for after <CODE>now()</CODE></P> <PRE><CODE>| where CertificateExpirationDate_epoch &lt; (now() + 90*86400) AND CertificateExpirationDate_epoch &gt; now() </CODE></PRE> Tue, 24 Sep 2019 20:45:53 GMT https://community.splunk.com/t5/Splunk-Search/Display-Dates-that-Expire-in-90-days/m-p/485703#M135905 jacobpevans 2019-09-24T20:45:53Z