Hello, I need to find a way to use another field for _Time on a single query (I don't want to change props just for 1 query) Sample Time: 2021-06-19T04:15:59.845Z I've tried several strptime I've seen in other questions but to no avail. I did get one to format previously for a table format using the following | eval SeenTimeStringConverted=strftime(strptime(Time,"%Y-%m-%dT%H:%M:%S.%6N"),"%m/%d/%Y %H:%M:%S %p") Here's my query I've been working on. sourcetype="aws:cloudwatchlogs:securityhub" "CIS" "detail.findings{}.Compliance.Status"!=NULL | rename "detail.findings{}.FirstObservedAt" as Time | eval _time=strptime(Time,"%Y-%m-%dT%H:%M:%S.%6N") | timechart count by "detail.findings{}.Compliance.Status"
... View more