Thank @yuanliu . I had missed "%FT%" & ":z" when i tried.  @ITWhisperer Here are few things i have tried till now :  1.  | inputlookup 7days_Trail.csv | eval time=strptime(_time, "%FT%H:%M:%S.%Q:%z") | table time 2xx 4xx 5xx After using the above query, the data looks like below: and the graph looks like where time was not getting updated/populated.  2. Since _time was not getting populated even after formatting, i used table command directly. Looks like its working. Can you please confirm if I can use this approach ?    ... View more

_time field looks something like "2023-09-06T18:30:00.000+00:00" in the lookup CSV. Whereas in the results generated by the query it looks like "2023-09-06 18:30:00" I tried converting the _time field as suggested with help of one of solutions provided earlier by you (Solved: Re: convert date to epoch - Splunk Community). But no luck. Can you please help with the query? ... View more