Hi, in my index I have a couple time fields that are returned via a simple search _time = 1/20/2022 1:38:55.000 PM (the Splunk-generated time) body.timestamp = 2022-01-20T21:38:45.7774493Z (the transaction time from our log) I am trying to format the time output with the convert function but can only get the first result to return. | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(_time) AS timestamp = 2022-01-20 21:38:55 | convert timeformat="%Y-%m-%d %H:%M:%S" ctime(body.timestamp) AS timestamp2 = none Am I missing something for the second timestamp to be returned? Thanks! ... View more