App: SA-ldapsearch (Version 2.2.0)
There is a difference between the output of ldapsearch and ldapfilter when it comes to the whenCreated attribute.
In ldapfilter the output is not a date, but code that looks like it is supposed to format the date.
You can see it by running this query:
|ldapsearch domain=default search="(sAMAccountName=Administrator)" attrs="sAMAccountName,whenCreated" |eval ldapsearch_whenCreated=whenCreated |ldapfilter domain=default search="(sAMAccountName=$sAMAccountName$)" attrs="whenCreated" |eval ldapfilter_whenCreated=whenCreated |table sAMAccountName, ldapsearch_whenCreated, ldapfilter_whenCreated