-- your search | rex "^(?<day>\d+)/(?<month>\d+)/(?<year>\d+)," | rex "^(?<year>\d+)-(?<month>\d+)-(?<day>\d+)," | eval _time=strptime(year."/".month."/".day, "%Y/%m/%d") ... View more

Hi Rich, Thanks it's working now but it's wroking with below code: eval hour=strftime(_time,"%H") | where (hour >= 7 AND hour < 10) . I am getting hour as spaces if i use strptime function as mentioned by you. ... View more