I am creating a search that detects compliance received from palo alto signatures we are receving 4 sets of dates: app-release-date av-release-date wildfire-release-date threat-release-date one of these dates (app-release-date) does not get updated daily, meaning  if today's date is 5/20/2021 the last updated release for the app-release date could be 4/20/2021 Now creating a pie chart comparing today's date, it will show that the app-release-date is out of date by 30 days but that is not the case, it just means that the most recent date for app-release-date is dated 4/20/2021. The question is how will I use the 4/20/2021 in an "eval=case" condition and using the 4/20/2021 as the most recent date instead of "now()" conditions For your perspective this is what I've done if using the "now()" conditions as a variable: | eval av-release-date=round(strptime('av-release-date', "%Y-%m-%d %H:%M:%S")), today=now(), timediff=today-'av-release-date', chart_date=strftime('av-release-date', "%Y-%m-%d") | eval color=case(timediff<=86400, "within 24 hrs", timediff>86400 AND timediff<=259200, "within 72 hrs", timediff>259200 AND timediff<=604800, "within 168 hrs", timediff>604800, "over 168 hrs") | stats count by color this returns a chart that look like this: The app-release-date conditions will be: The most recent = Green -----> the most recent is not "now()" but it could be 4/20/2021 Most recent – 7 days = yellow Most recent – 30 days = red Most recent  > 30 days = black Please advise, and thank you in advance. Regards,   ... View more