The command to use here is strftime (epoch to string) not strptime (string to epoch), or use convert command's ctime funtion. Try like this | dbinspect index= | stats min(startEpoch) as oldest max(endEpoch) as latest by index | join type=outer [| rest /services/data/indexes/ | fields title currentDBSizeMB frozenTimePeriodInSecs maxTotalDataSizeMB | rename title as index] | eval premature_aging=if(((now() - 188697600)*1.1) < oldest,"smoke…fire?","aging nicely") | convert ctime(oldest) ctime(latest) timeformat="%F %T" ... View more

the new indexers are to be configured as part of a multi-site cluster hence have the site=siteNumber in server.conf ... View more