The convert ctime() command is setting the format implicitly. It has nothing to do with the strptime() and strftime() functions, which are just being used to calculate an offset.
Try...
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(latest_alert_time) AS latest_alert_time
By the way, mathematically this...
| eval _time=_time-(strptime(strftime(_time,"%Y-%m-%dT%H:%M:%S")." GMT+8","%Y-%m-%dT%H:%M:%S%Z")-_time)
...is the same as this...
| eval _time=strptime(strftime(_time,"%Y-%m-%dT%H:%M:%S")." GMT+8","%Y-%m-%dT%H:%M:%S%Z")
... and is calculating the actual UTC value of _time , assuming that originally the _time was set as GMT+8 (China or Western Australia). Those time zones do not appear to have a daylight savings time adjustment, so the simple and fixed conversion should work fine.
... View more