App: SA-ldapsearch (Version 2.2.0)
There is a difference between the output of ldapsearch and ldapfilter when it comes to the whenCreated attribute.
In ldapfilter the output is not a date, but code that looks like it is supposed to format the date.
You can see it by running this query:
|ldapsearch domain=default search="(sAMAccountName=Administrator)" attrs="sAMAccountName,whenCreated"
|eval ldapsearch_whenCreated=whenCreated
|ldapfilter domain=default search="(sAMAccountName=$sAMAccountName$)" attrs="whenCreated"
|eval ldapfilter_whenCreated=whenCreated
|table sAMAccountName, ldapsearch_whenCreated, ldapfilter_whenCreated
