How do I change the first and last time to actual timeformat="%y-%m-%d %H:%M"?

[neely_hpe]

I am looking to take the default datamodel search --

| tstats summariesonly max(_time) as lastTime from datamodel=Malware.Malware_Attacks by Malware_Attacks.signature,Malware_Attacks.dest | drop_dm_object_name("Malware_Attacks") | lookup local=true malware_tracker dest,signature OUTPUT firstTime | eval dayDiff=round((lastTime-firstTime)/86400,1) | search dayDiff>30

But I want to display the actual y-m-d-H-M vs the numeric lastTime and FirstTime values.

How can I do this?

[Shan]

@neely_hpe,

Try below example..
It can run anywhere ..

| makeresults 
| eval Time =_time 
| eval Epoc_To_YMD=strftime(Time,"%Y-%m-%d %H:%M:%S")
| eval Date_to_Epoc=strptime(strftime(_time,"%Y-%m-%d %H:%M:%S"),"%Y-%m-%d %H:%M:%S")
| table _time Time Epoc_To_YMD Date_to_Epoc

Thanks