The strptime function unfortunately does not include a default to the first day of the month when extracting Mmm-yy or YYYY-MM format dates. Therefore, you have to concatenate a 01 onto the end and tell splunk that the 01 is the day.
This makes your test data...
| makeresults | eval mydate="May-15 Dec-15 Jan-16 Feb-16 Mar-16 Apr-16" | makemv mydate | mvexpand mydate
This converts it to epoch time and a display version of the epoch time...
| eval mydateEpoch=strptime(mydate."-01","%b-%y-%d")
| eval mydateDisplay=strftime(mydateEpoch,"%Y-%m-%d")
Either one of these filters for dates from Feb 2016 forward...
| where mydateDisplay>="2016-02-01"
...or...
| where mydateEpoch >= strptime("2016-02-01","%Y-%m-%d")
For efficiency reasons, you always want to filter out records as early as possible, before doing calculations, so this would be the proper order...
| makeresults | eval mydate="May-15 Dec-15 Jan-16 Feb-16 Mar-16 Apr-16" | makemv mydate | mvexpand mydate
| eval mydateEpoch=strptime(mydate."-01","%b-%y-%d")
| where mydateEpoch >= strptime("2016-02-01","%Y-%m-%d")
| eval mydateDisplay=strftime(mydateEpoch,"%Y-%m-%d")
... View more