https://community.splunk.com/t5/Splunk-Search/Filter-by-time-where-date-is-in-seperate-field/m-p/465255#M191671 <P>You can create _time field right in search query, like this:</P> <P><CODE><BR /> | eval _time=strptime(Created,"%Y-%m-%d %H:%M:%S")</CODE></P> Thu, 12 Dec 2019 13:02:49 GMT eduardKiyko 2019-12-12T13:02:49Z https://community.splunk.com/t5/Splunk-Search/Filter-by-time-where-date-is-in-seperate-field/m-p/465254#M191670 <P>I need some help to filter by time, but the time field is not the internal Splunk time field. Instead, it is a date field from a lookup spreadsheet that corresponds to the objects file creation. </P> <P>I want to be able to filter on objects that are created only in the previous month. </P> <P>The format of the lookup date field is like this:</P> <P>Created=8/26/2019 17:01 </P> Thu, 12 Dec 2019 12:51:02 GMT https://community.splunk.com/t5/Splunk-Search/Filter-by-time-where-date-is-in-seperate-field/m-p/465254#M191670 user93 2019-12-12T12:51:02Z https://community.splunk.com/t5/Splunk-Search/Filter-by-time-where-date-is-in-seperate-field/m-p/465255#M191671 <P>You can create _time field right in search query, like this:</P> <P><CODE><BR /> | eval _time=strptime(Created,"%Y-%m-%d %H:%M:%S")</CODE></P> Thu, 12 Dec 2019 13:02:49 GMT https://community.splunk.com/t5/Splunk-Search/Filter-by-time-where-date-is-in-seperate-field/m-p/465255#M191671 eduardKiyko 2019-12-12T13:02:49Z