How to leave date (in a field) is before today?

[KH]

I'm extremely new to Splunk and finding learning SPL very frustrating.

I'm trying to look for windows log on events/ attempted log ons by leavers accounts after their last working day. How do i say where a specific field (the last working day) is before todays date. 

The last working day field which I'm pulling from a separate index is in the following format "2020-02-28 00:00:00.0"

[KH]

thank you! 

[ITWhisperer]

You need to parse the last working day into an epoch time, then compare it to the epoch time for the start of the current day.

| where strptime(last_working_day_field,"%Y-%m-%d %H:%M:%S") < relative_time(now(),"@d")