hank you giuseppe. the main query returns over 50k results, but the sub-query does not. i should have included that the values being extracted for "login_dye" are strictly numerical. the value being extracted from the main query matches the value being extracted from the sub-query. here is the query in code sample: tag=tagname location="location name" message="error message" status=400 | rex field=raw "string from log (?\w+[@]\S+)@string from log" | rex field=raw "(?\w+)]" | join type=inner login_dye [search tag=tag name "string from log" "\"status\":400" "string from log" | rex field=field name "(?\w+)" | eval Date=strftime(_time, "%m-%d-%y")] | eval user_email="'".user_email."'," | dedup Date, user_email | table Date, user_email ... View more

If I understand your question: strptime() creates a time object from a string. For output or string conversion, you format time objects via strftime() or the convert command. So... Created=strptime(Created,"%Y-%m-%dT%H:%M:%S.%3N%z") ... basically takes the current value of "Created", which is a string, and replaces that field with a time object. The time object doesn't have a "format" per se. Here are a few example conversions: eval dayofweek=strftime(_time,"%w") eval hour=strftime(_time,"%H") eval yymmdd=strftime(tstamp,"%y%m%d") eval minute=strftime(_time,"%y%m%d%h%M") truncate time to the current minute, then convert to epoch format string: eval trunc_minute=strftime(strptime(strftime(_time,"%y%m%d%H%M"),"%y%m%d%H%M"),"%s") the more succinct way: eval trunc_minute=strftime(relative_time(_time, "@m"),"%s") ... View more