Hi, I have tried to solve your problem. This answer might help you further into solving your question. Keep in mind, that there might be a more efficient solution for this. I just used the splunk internal index _audit to simulate your setup. Here is what I go so far, this is the solution for past 15 days (to apply this to past 15 to 30 days isn't that hard) index=_audit | eval opened_at=strftime(_time,"%d/%m/%Y %H:%M") | rex field=opened_at "(?<day>\d+)\/(?<month>\d+)\/(?<year>\d+)" | eval range=day+month+year | eventstats max(range) AS latest_range | where range>latest_range-15 | table _time day month year range latest_range ... View more

Also, "%b" could be used at the end to get the 3-character month abbreviation. Links for reference: Eval Date and Time functions Common Time Format Variables ... View more