Basic Query using Dates

[modulussplunk]

We have indexed fields like the following:

fname (a-z*)
lname (a-z*)
pdate (name_month day year)
policy ( strong or weak)

I'm able to do a query and returned all of the usernames with a strong policy (policy = 'strong').

If I try to also query for a password change date prior to May 1st (pdate > 'May 25 2019'), I get results with users that have password changes after that date.

I believe I need to somehow convert the date perhaps with the strftime function, because maybe it's not comparing the the fields as dates, but how would I do that and actually construct the query? I've read the docs and tried some copy/pastes w/o a working solution.

Thanks

[bandit]

So the first question is. Can you index pdate as your _time field?

If pdate is not indexed as the _time field i.e. primary time key you cannot use it to search with the default time picker dropdowns or search command line time modifiers. I believe you would have to convert to epoch time first etc. and then compare to current time in epoch time to do a calculation for more than 30 days. Essentially you are converting pdate to epoch time seconds a number that you can use > = or < to compare against.

For converting dates to a number see:
https://answers.splunk.com/answers/595091/converting-date-to-epoch-time.html

[modulussplunk]

Thanks rob_jordan. I should have mentioned. I don't need to search with the default time picker drop downs, but 'within' search bar itself. We feed the data daily so the default time picker drop down doesn't mean too much. We actually use the dedup command on the search bar.

But, I apologize. That link might make sense to you or others but I'm just getting started with Splunk. I'm still a bit unsure of the syntax. From my understanding, it seems like it would the search query look something like, this?

index="blah1" sourcetype="blah2" policy = "strong" mypdate > ($epoch_number_for_desired_date)| eval mypdate = strptime('mypdate', "%m %d %y")

Thank you