I tried this it didn't work. First of all it complained about the format of strftime so I changed it to | eval BST=strftime(TransactTime/1000000000, "%d/%m/%y %H:%M:%S %Z" ) | eval NY=strptime(BST."-0500","%d/%m/%y %H:%M:%S %Z") | convert ctime(BST) | table host, BST, NY, TransactTime
... View more