How to compare timestamps? I want to compare timestamps of two events and determine which happened first?

[sridhar2901]

I want to compare two values of _time field and tell which event occurred first.

[ansif]

Convert 2 fields to epoch time then do a comparison using where command to list only events which occurred first.