https://community.splunk.com/t5/Splunk-Search/How-can-I-use-the-quot-where-quot-function-to-find-where-the/m-p/325017#M159909 <P>Your are the man with the juice!!!</P> Tue, 25 Jul 2017 16:05:32 GMT GHOST27 2017-07-25T16:05:32Z https://community.splunk.com/t5/Splunk-Search/How-can-I-use-the-quot-where-quot-function-to-find-where-the/m-p/325015#M159907 <P>Ex: | where first_seen&lt;"24h" or where first_seen="-1d" this is what I used but obviously it's wrong.</P> Tue, 29 Sep 2020 15:01:25 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-use-the-quot-where-quot-function-to-find-where-the/m-p/325015#M159907 GHOST27 2020-09-29T15:01:25Z https://community.splunk.com/t5/Splunk-Search/How-can-I-use-the-quot-where-quot-function-to-find-where-the/m-p/325016#M159908 <P>You would need to make use of relative_time function in there. </P> <P>If first_seen is in epoch format, then try like this</P> <PRE><CODE>..| where first_seen&gt;=relative_time(now(),"-24h") </CODE></PRE> <P>If it's not in epoch, need to convert it to epoch to compare</P> <PRE><CODE>..| where strptime(first_seen,"&lt;&lt;TimeFormatHere&gt;&gt;") &gt;=relative_time(now(),"-24h") </CODE></PRE> Tue, 25 Jul 2017 15:09:07 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-use-the-quot-where-quot-function-to-find-where-the/m-p/325016#M159908 somesoni2 2017-07-25T15:09:07Z https://community.splunk.com/t5/Splunk-Search/How-can-I-use-the-quot-where-quot-function-to-find-where-the/m-p/325017#M159909 <P>Your are the man with the juice!!!</P> Tue, 25 Jul 2017 16:05:32 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-use-the-quot-where-quot-function-to-find-where-the/m-p/325017#M159909 GHOST27 2017-07-25T16:05:32Z