Filter events based on date that is currently a string?

[craigbar]

I am trying to filter results based on relative date (last 6 months). Splunk extracted the field I would like to use as a string. Here is an example: Computer Last Seen = "Mon Jun 01 20:26:49 EDT 2015". I have been attempting to use eval strptime to get create a field while searching. It is not working.

Can anyone suggest a better approach?
Thanks.

[woodcock]

Assuming the field that Splunk extracted is called Computer_Last_Seen, try this (15552000=6 months in seconds):

... | lastSeenTimeEpoch = strptime(Computer_Last_Seen, "%a %b %d %H:%M:%S %Z %Y") | eval AgeSeconds = now() - lastSeenTimeEpoch | where AgeSeconds < 15552000