Hi again,
doesn't work for me too. Same for BootEndTime \:\(

For BootStartTime we can use the information from the Message column (9).
Now it starts to get ugly. Note the split on ":[TAB]" and for format reasons the join split on ?/"". Next thing you need to know is that these are UTC times. so there will be a bit calculation work left for you to do.

 Code:
"BootStartTime: " + join(split(split($events[0,9],":	")[4],'?'),'') ?
_________________________