Ended up with the same challenge as listed here and none of the suggested replies on this article helped in any way.   Here is my solution:   <my search> | rex field=New_Time mode=sed "s/[^ -~]//g"   | rex field=Previous_Time mode=sed "s/[^ -~]//g"  | eval time_drift = (strptime(New_Time, "%Y-%m-%dT%H:%M:%S.%9QZ") - strptime(Previous_Time,"%Y-%m-%dT%H:%M:%S.%9QZ"))  | table _time New_Time time_drift    Problem:  The field with the Windows timestamps includes non-printable character - I thinks it's a x80, but it doesn't really matter.  I use the rex mode=sed to remove anything that is not in the printable range.  [^ -~] matches all non-printable character, and mode=sed will just remove them from the string.  After this replacement, the strptime() function works correctly.     
						
					
					... View more