I have some search results that return values in the format %Y-%m-%d %H:%M:%S. For example:
...some search... | table UpdateTime
This would yield the following table:
I know for a fact that time string is in UTC, not my local time. All I need to do is display the number of minutes that have elapsed between that UTC string and the time the event was recorded (_time). Everything I try keeps giving me negative numbers for recent events, I assume because it is treating the UpdateTime field as being in local time, not UTC.