Convert outputted time (epoch) to readable Date/time

[gerald_huddlest]

sure this is very similar to other questions but I have not been able to apply any of the suggestions successfully.

Search as follows:
sourcetype="adloader" | stats min(_time) AS earliest max(_time) AS latest by TransactionID | eval duration=latest-earliest | fields - latest

output

TransactionID - earliest - duration

21354ewer12 - 1330088785.771 - 1.954

how can I convert the earliest column to proper date/time format.

[Ayn]

Convert it to some time format you prefer using eval and strftime. "%+" is often a good quick format modifier for getting a readable timestamp.

sourcetype="adloader" | stats min(_time) AS earliest max(_time) AS latest by TransactionID | eval duration=latest-earliest | eval earliest=strftime(earliest,"%+") | table TransactionID earliest duration