Why is my timestamp not working in Windows event logs?

[HCadmins]

Here is my search

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "Yes", "No") | table _time user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"

When I look at the log raw data, there is clearly a time stamp.

[richgalloway · Accepted solution]

The stats command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats or streamstats.

[HCadmins]

Okay, that made it work. Why is count in there twice?

streamstats count count(eval...)

(I used this code snipped from another Splunk answer)

[richgalloway]

The first counts all events and the second counts only those events where EventCode=4740.

[woodcock]

What is your inputs.conf for this?

Are your indexers using NTP? Do you have the TZ settings correct for this input?

[HCadmins]

My time zone settings are correct, as other inputs are correctly recording time.

If I remove most of the search string like this

index=wineventlog Account_Domain=* | table _time

The time shows up perfectly.

[HCadmins]

When I add in the | stats part is when it seems to break

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | table _time

Shows no results