You got it backwards.  strptime can get you _time into the real time value so you can use timechart.  Why name the variable time instead of _time?  timechart command only works with field _time. | inputlookup 7days_Trail.csv | eval _time=strptime(_time, "%FT%H:%M:%S.%Q:%z") | timechart avg(*) as * You can replace avg with any stats function that suits your need.  ... View more