I have gone through the forums looking for an answer to this, but nothing has worked.  I am trying to convert a string to a date.  I have data in an index that is extracted, with a field named Expiration_Date that contains a string that is actually a date/time, such as 5/22/2022 10:10:25 PM. I found that this query works properly: | makeresults | eval x="08/04/16 9:40:41 PM" | eval y=strptime(x, "%m/%d/%y %H:%M:%S") | eval z=strftime(y, "%m/%d/%Y") | table x y z This query outputs the converted time properly in the z field.  However, when I try to use this with my data, as such index = ssl_certs | eval x=Expiration_Date | eval y=strptime(x, "%m/%d/%y %H:%M:%S") | eval z=strftime(y, "%m/%d/%Y") | table Expiration_Date, x, y, z The x field is equal to the Expiration_Date field, but y and z fields are empty.  Is there something special I am missing here with loading in the values of the Expiration_Date field into the eval statements? ... View more