I am using the code for date but this is the time the event was created, not when it really happened. See Details

[tcupp]

| convert ctime(_time) AS Time timeformat="%m/%d/%y". Can "event.InventoryEventCarpet.InventoryEventCreateDateTime" be used. I can not get this field to work. The index is shopflex. Here is the dashboard: http://cimsplunk/en-US/app/Plant_WG/ols_production_report/edit

[DalJeanis]

That's an internal site. we are not going to be able to look at it. Please post a non-confidential description of it.

For the most part, your answer will be:

 your search that gets some of the records
 | head 10 
 | eval myDate = event.InventoryEventCarpet.InventoryEventCreateDateTime
 | table _time myDate

See what format the EventCreateDateTime is actually in. Once you know that, you can convert it properly to an epoch date/time.