After Mary's answer, I played around with this a bit more and voila: index=SomeIndex earliest=10/23/2019:12:00:00 latest=10/28/2019:12:00:00 | eval UserLower=lower(User) | timechart count by UserLower | rename UserLower as "User ID" **| eval timeOffset=strftime(_time, "%:::z") | eval _time=strftime(_time - 60*60*timeOffset, "%Y-%m-%dT%H:%M:%SZ")** Conclusion: You need to evaluate your readable date format (whatever that is) on top of the _time field only AFTER you have asked splunk to produce the timechart using the original _time field (which holds the time in Unix time format just the way splunk likes it). Please feel free to comment and suggest more elegant/appropriate solutions. ... View more

Unfortunately the C# sdk has been broken since the new auth mechanisms were put in place circa 7.1+ ... View more