Thank you Ayn for explaining your answer so well.
I was still running into a problem because of the ctime(*) expression used in the convert command.
ctime(*) made the time conversion run against ALL fields (including Workstation_Name and Account_Name) which caused them to be excluded from results. Understanding this, I now call each field I want to convert directly:
|convert timeformat="%m/%d/%y %H:%M:%S" ctime("Logon Time") ctime("Logoff Time")
I also chose to use mvjoin to combine multiple values into (Workstation_Names) and (Account_Names)
Here is the final working search:
index=domaincontrollers sourcetype="WinEventLog:Security" accountname | eval time=_time |timechart span=1d min(time) as "Logon Time", max(time) as "Logoff Time" values(Account_Name) as Account_Names values(Workstation_Name) as Workstation_Names | eval Account_Names=mvjoin(Account_Names, ", ")| eval Workstation_Names=mvjoin(Workstation_Names, ", ") |convert timeformat="%m/%d/%y %H:%M:%S" ctime("Logon Time") ctime("Logoff Time")
... View more