Ended up with the same challenge as listed here and none of the suggested replies on this article helped in any way. Here is my solution: <my search> | rex field=New_Time mode=sed "s/[^ -~]//g" | rex field=Previous_Time mode=sed "s/[^ -~]//g" | eval time_drift = (strptime(New_Time, "%Y-%m-%dT%H:%M:%S.%9QZ") - strptime(Previous_Time,"%Y-%m-%dT%H:%M:%S.%9QZ")) | table _time New_Time time_drift Problem: The field with the Windows timestamps includes non-printable character - I thinks it's a x80, but it doesn't really matter. I use the rex mode=sed to remove anything that is not in the printable range. [^ -~] matches all non-printable character, and mode=sed will just remove them from the string. After this replacement, the strptime() function works correctly.
... View more