After running my query: | metadata type=sourcetypes index= OR index=_**
I get the following columns:
firstTime lastTime 1578610402 1580348515
How would I convert this time to a readable format?
your search | convert ctime(firstTime) | convert ctime(lastTime)
yes, command is convert.
convert
