You're a very nice gentlemen my friend! Issue is fixed I just have one more issue, when I try to rename my column header, it converts it again to an Epoch time, this is my new modified search with your solution: index=myIndex host=myHost confirmationNumber step_code="'BOOKING_DONE'" earliest=01/01/2019:00:00:00 latest=12/31/2019:00:00:00 | spath | timechart span=1mon count by Resort limit=0 | addtotals | addcoltotals | table _time, 'BBO', 'BNG', 'BRP', 'BTC', 'INN', 'NGA', 'SAT', 'SBD', 'SBR', 'SEB', 'SGL', 'SGO', 'SHC', 'SLS', 'SLU', 'SMB', 'SNG', 'SRB', 'SRC', 'SWH', Total | fieldformat _time=strftime(_time, "%B %Y") | rename _time AS "Month"
... View more