Formatting my date

[rickettw]

Below is my report but my date output is blank, i am searching for powershell events on my network and need to know what date these events occurred, any suggestions?

sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1" | stats count as Event_Count values(user) as User values(computer_name) as Computer_Name values(category) as Category values(application_name) as Application_Name values(strftime(_time, "%d/%m/%Y")) as Time by ip_address| sort -Event_Count _time

Thanks much.

[woodcock · Accepted solution]

Try this:

sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1"
| stats count as Event_Count list(user) as User list(computer_name) as Computer_Name list(category) as Category list(application_name) as Application_Name list(eval(strftime(_time, "%d/%m/%Y"))) as Time by ip_address
| sort -Event_Count _time

[richgalloway]

I've had mixed results using eval within stats so I would use a separate eval.

 sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1" | eval Time=strftime(_time, "%d/%m/%Y") | stats count as Event_Count values(user) as User values(computer_name) as Computer_Name values(category) as Category values(application_name) as Application_Name values(Time) as Time by ip_address| sort -Event_Count Time

[cmerriman]

add eval into your Time command.

values(eval(strftime(_time, "%d/%m/%Y"))) as Time

[micahkemp]

Your stats search named the values() function output Time, so _time isn't available. Try changing your sort to:

sort -Event_Count Time

Or change your values() function to name the field _time.

Edit: and change your values() function to use eval(), as per the answer below.