I mean, to be more specific...
The EventTime column, and the Message column, is the same.But the value in EventTime, "the time is different" ,
Thank you in advance for your comments.
Greetings
Some time events are shown in the SWQL studio in UTC, as that is how it is recorded in the database. The GUI shows it in your local time zone. If you want the same time in SWQL, use ToLocal(EventTime) as LocalEventTime for example.
Thank you @stevenstadel now I see the correct form.
Look for more than what you mentioned, and if someone else sees this post, I leave a guide on the use of more functions, I hope it helps:
References: github.com/.../SWQL-Functions
