https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-compare-two-dates/m-p/202437#M58725 <P>I am assuming when you are comparing greater than or less than you mean epochNumber of _time is greater/less than epoch number of "2016-01-01". Give this a try please and adjust greater than or less than according to your like in eval status1 command:</P> <PRE><CODE>yourBaseSearch to get the _time |eval myNewTime=strptime("2016-01-01", "%Y-%m-%d") | eval time1=strftime(_time, "%Y-%m-%d") | eval epoch_time=strptime( time1, "%Y-%m-%d") | eval status1=case( epoch_time &lt; myNewTime, "Yes", 1=1, "No" ) | table _time, epoch_time, myNewTime, status1, Name, Rank </CODE></PRE> Wed, 02 Nov 2016 04:00:09 GMT gokadroid 2016-11-02T04:00:09Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-compare-two-dates/m-p/202436#M58724 <P>I want to compare two dates using case statement<BR /> Theoretically, case( _time &gt; "2016-01-01") . If True, Print "Yes" in New column status1</P> <P>Below is the search, but I am not getting any results. Can you please help?</P> <PRE><CODE>index="test4" sourcetype="test2" | convert timeformat="%Y-%m-%d" ctime(_time) AS c_time | eval status1 = case(c_time &lt; strptime(strptime("2016-01-01","%Y-%m-%d"),"%Y-%m-%d") , "Yes") |table _time, c_time, Status1 , Name, Rank </CODE></PRE> <P>Note: I'm using <CODE>strptime</CODE> twice to convey from epoch.</P> Wed, 02 Nov 2016 03:09:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-compare-two-dates/m-p/202436#M58724 splunk_hvijay 2016-11-02T03:09:49Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-compare-two-dates/m-p/202437#M58725 <P>I am assuming when you are comparing greater than or less than you mean epochNumber of _time is greater/less than epoch number of "2016-01-01". Give this a try please and adjust greater than or less than according to your like in eval status1 command:</P> <PRE><CODE>yourBaseSearch to get the _time |eval myNewTime=strptime("2016-01-01", "%Y-%m-%d") | eval time1=strftime(_time, "%Y-%m-%d") | eval epoch_time=strptime( time1, "%Y-%m-%d") | eval status1=case( epoch_time &lt; myNewTime, "Yes", 1=1, "No" ) | table _time, epoch_time, myNewTime, status1, Name, Rank </CODE></PRE> Wed, 02 Nov 2016 04:00:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-compare-two-dates/m-p/202437#M58725 gokadroid 2016-11-02T04:00:09Z