Hi srinathd,
based on your provided example try this run everywhere command:
index=_internal | head 1 | eval foo="20090930" | eval boo=strptime(foo, "%Y%m%d") | table foo, boo
where boo will be the epoch time. You can verify it by running this search:
index=_internal | head 1 | eval foo="20090930" | eval boo=strptime(foo, "%Y%m%d") | convert ctime(boo) AS newTime | table foo, boo, newTime
hope this helps ...
cheers, MuS
