I run a command as below try to get all the locked out accounts, and get the date like %Y-%m-%d as well. But seems always get numbers.
|ldapsearch domain=default search="(&(objectClass=user)(lockoutTime>=1)(!(objectClass=computer)))" attrs="sAMAccountName, lockoutTime, mail" | eval testDate=strptime(lockoutTime,"%Y-%m-%d")|rename sAMAccountName as assoc_user | table assoc_user, lockoutTime, testDate, mail
assoc_user lockoutTime testDate↕ mail↕
s12345 2015-07-28T06:06:55.809482Z 1438005600.000000 abcd@xyz.com
... View more