Make timestamps human readable

Epoch seconds are fine for machines. For a dashboard someone else has to read, format the field once at search time and never think about it again.

The one-liner

| eval when = strftime(_time, "%Y-%m-%d %H:%M:%S")

strftime takes an epoch field and a format string and hands back a readable string. Do it once, near the top of the search, and every panel downstream inherits it.

Formatting a field that is not _time

The same works for any epoch field — a lookup column, a parsed value, anything:

| eval opened = strftime(open_epoch, "%F %T")

%F and %T are shorthand for the date and time formats above, if you would rather not spell them out.

Going the other way

When you need to compare a human-entered date back to epoch, strptime is the inverse. Keep both in the same note so you never reach for the wrong one.