Please check below query guys the best result i have got, | `inactive_accounts(30)` | eval LastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S.%Q") | sort -_time happy splunking!!!
... View more
Please try this below query guys the best i have got the result as expected | `inactive_accounts(30)` | eval LastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S.%Q") | sort -_time
... View more