For time compares, you have to first convert the time to epoch format (seconds). The difference between two times, is always in seconds. So, to get the time in days, you can divide by 86400 (secs per day) | ldapsearch domain=internal search="(&(objectclass=user)(!(objectClass=computer)))" limit=10 attrs="sAMAccountName, displayName, distinguishedName, userAccountControl, whenCreated, accountExpires, lastLogonTimestamp" | makemv userAccountControl | search dn!="*OU=_Disabled Users*" | eval accountDisable=if(userAccountControl == "ACCOUNTDISABLE NORMAL_ACCOUNT", "Yes", "No") | eval dontExpirePasswd=if(userAccountControl="DONT_EXPIRE_PASSWD NORMAL_ACCOUNT", "Yes", "No") | eval passwdNotRequired=if(userAccountControl == "PASSWD_NOTREQD NORMAL_ACCOUNT", "Yes", "No") | eval lastLoginAge_epoch=strptime(lastLogonTimestamp, "%Y-%m-%dT%H:%M:%S") | eval lastLoginAge=round((lastLoginAge_epoch - now())/86400, 0) | table sAMAccountName, displayName, dn, userAccountControl, whenCreated, accountDisable, dontExpirePasswd, passwdNotRequired, lastLoginAge, lastLogonTimestamp, accountExpires ... View more