https://community.splunk.com/t5/Splunk-Search/Where-time-gt-3-22-2018/m-p/308075#M92441 <P>Try this </P> <PRE><CODE>index=... | eval epoch=strptime("YOUR_TIME_FIELD", "%m/%d/%Y") | where epoch &gt;1521748648 </CODE></PRE> Thu, 29 Mar 2018 19:58:51 GMT skoelpin 2018-03-29T19:58:51Z https://community.splunk.com/t5/Splunk-Search/Where-time-gt-3-22-2018/m-p/308074#M92440 <P>I have events that only time stamp is the Splunk generated _time and I only need to return events after a certain date, 3/22/2018. Simply adding "Where _time &gt; 3/22/2018" does not work and I have attempted converting _time and comparing against that to no avail. </P> <P>Any suggestions?</P> Thu, 29 Mar 2018 19:36:52 GMT https://community.splunk.com/t5/Splunk-Search/Where-time-gt-3-22-2018/m-p/308074#M92440 griffinpair 2018-03-29T19:36:52Z https://community.splunk.com/t5/Splunk-Search/Where-time-gt-3-22-2018/m-p/308075#M92441 <P>Try this </P> <PRE><CODE>index=... | eval epoch=strptime("YOUR_TIME_FIELD", "%m/%d/%Y") | where epoch &gt;1521748648 </CODE></PRE> Thu, 29 Mar 2018 19:58:51 GMT https://community.splunk.com/t5/Splunk-Search/Where-time-gt-3-22-2018/m-p/308075#M92441 skoelpin 2018-03-29T19:58:51Z https://community.splunk.com/t5/Splunk-Search/Where-time-gt-3-22-2018/m-p/308076#M92442 <P>If <CODE>_time</CODE> is the time you want to use for searches, using the time picker should work just fine.</P> Wed, 13 Jun 2018 03:50:31 GMT https://community.splunk.com/t5/Splunk-Search/Where-time-gt-3-22-2018/m-p/308076#M92442 jihape 2018-06-13T03:50:31Z