i have 2 queries .
(index=abc OR index=def) category= * OR NOT blocked =0 AND NOT blocked =2|rex field=index "(?<Local_Market>[^cita]\w.*?)_"| stats count(Local_Market) as Blocked by Local_Market| addcoltotals col=t labelfield=Local_Market label="Total"| append [search (index=abc OR index=def) blocked =0 | rex field=index "(?<Local_Market>\w.*?)_"| stats count as Detected by Local_Market| addcoltotals col=t labelfield=Local_Market label="Total"]| stats values(*) as * by Local_Market| transpose 0 header_field=Local_Market column_name=Local_Market | addinfo| eval date=info_min_time| fieldformat date=strftime(date,"%m-%d-%Y")| fields - info_*
1> above query is giving me the correct date time ..but when i am scheduling this as report its coming as Epoch time in csv file ..
2> also how can we get date field in first column instead of last column without disturbing the other fields ..
thanks in advance
1> Use eval rather than fieldformat to have the format preserved in the CSV.
2> Use the table command to specify the order of fields.
@richgalloway table command wont work here i believe .. as we are already using stats command ..please correct me if i am wrong ..