https://community.splunk.com/t5/Splunk-Search/How-would-I-write-the-following-if-statements-in-Splunk/m-p/599280#M208629 <LI-CODE lang="markup">| stats latest(_time) as _time latest(access) as access | where access="start_access" AND now()-_time &gt; (20*24*60*60) | eval result="not active"</LI-CODE> Wed, 25 May 2022 12:31:54 GMT ITWhisperer 2022-05-25T12:31:54Z https://community.splunk.com/t5/Splunk-Search/How-would-I-write-the-following-if-statements-in-Splunk/m-p/599273#M208626 <P><SPAN>How would I write the following statements in Splunk?<BR />Variables are start_access and last_access<BR /><BR />Statement<BR />If 20 days have passed from the start_access AND there was no last_access since the last start_access, then the result is not active.<BR /></SPAN></P> Wed, 25 May 2022 15:34:27 GMT https://community.splunk.com/t5/Splunk-Search/How-would-I-write-the-following-if-statements-in-Splunk/m-p/599273#M208626 troy44112 2022-05-25T15:34:27Z https://community.splunk.com/t5/Splunk-Search/How-would-I-write-the-following-if-statements-in-Splunk/m-p/599280#M208629 <LI-CODE lang="markup">| stats latest(_time) as _time latest(access) as access | where access="start_access" AND now()-_time &gt; (20*24*60*60) | eval result="not active"</LI-CODE> Wed, 25 May 2022 12:31:54 GMT https://community.splunk.com/t5/Splunk-Search/How-would-I-write-the-following-if-statements-in-Splunk/m-p/599280#M208629 ITWhisperer 2022-05-25T12:31:54Z