This worked for me. You’ll need to convert your times to epoch, then convert to MM/DD/YY HH:MM as seen below. If you need, use http://strftime.net/ to verify. | eval endDateEpoch = strptime(accountExpires, "%Y-%m-%dT%H:%M:%SZ") | eval endDate = strftime(endDateEpoch, "%m/%d/%y %H:%M") | eval startDateEpoch = strptime(whenCreated, "%Y-%m-%d %H:%M:%S+00:00") | eval startDate = strftime(startDateEpoch, "%m/%d/%y %H:%M")
... View more