You could try a search like this: sourcetype=tickets | eval SubmitDateEpoch=strptime(SubmitDate,"%m/%d/%Y") | where SubmitDateEpoch > strptime("02/15/17","%m/%d/%Y") AND SubmitDateEpoch < strptime("02/20/17","%m/%d/%Y") You may also put the calculation into a macro (so everything starting from | eval ) and send the start end end date for your search to as arguments to that macro. The macro definition would be (given your variable names are arg1 and arg2): | eval SubmitDateEpoch=strptime(SubmitDate,"%m/%d/%Y") | where SubmitDateEpoch > strptime("$arg1$","%m/%d/%Y") AND SubmitDateEpoch < strptime("$arg2$","%m/%d/%Y") Your search could look like this in that case: sourcetype=tickets `submitrange("02/15/17","02/20/17")` ... View more