how to append original search result with the table

[cyberportnoc]

"number of scan:" | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table source, date, Event

there is no event column which i think is search result

[niketn]

I am not sure but if you need to show raw event data you should use _raw. Also if you just want to format time differently you should use fieldformat.

Try the following search :

<YourBaseSearch>
| fieldformat _time=strftime(_time,"%Y-%m-%d")
| table source, date, _raw

PS: if your intent is to group events together by day you should use timechart command to aggregate the data.

[cyberportnoc]

this is it, really thanks

[niketn]

@cyberportnoc, I have converted to answer. Please accept.