Hello All New to splunk and would like a bit of guidance on dealing with Active Directory attributes that ave dates such as accountExpires and pwdLastSet. For example; this work well source="ActiveDirectory" AND accountExpires="12:00.00 AM, Tue 01/01/2013" AND accountExpires>0 | dedup name | search userAccountControl="512" However I would really like to see everything that expires prior to this date. "<" does not work because I suspect splunk see's this value as a string. Anyone have some examples of efficient ways to accomplish what I am looking for. TY ... View more