I finally figured out how to get it to work. It is necessary to use two eval functions to convert the datetime values in the CSV to the epoch form. For some reason for events from the CSV I first had to use eval to assign _time to another variable (I used "Time") for the text format to appear. I then used another eval and the strptime function on the Time variable to convert it to epoch time. So my subsearch ended up this way: append [|inputlookup bsod_samples.csv | eval Time=_time | eval _time=strptime(Time,"%Y-%m-%dT%T.%Q%:z")] Date format in CSV: 02/06/2014 13:46:31 -0500 ... View more

I added it myself, it didn't exist before as well. ... View more