(A) you can always edit your original question. It "flows" better than appending an update to your question as a new answer to your question. Splunk Answers is rather unlike a web forum in that way. (B) If pwdLastSet is the field that has your other timestamp in it, then that is what needs to be the first argument to strptime . Also, your strptime format string needs to match the timestamp format of the string. Otherwise it doesn't work. See my updated answer. ... View more