I have a csv that gets loaded weekly... timestamp for events are on load. However, this file has multiple time fields (first discovered, last seen, etc.). I am attempting to find those events (based on the fields) that are greater than 30 days, for example. had this working fine, until I introduced a lookup. I am attempting to show results grouping them by owner (stats) but only those events that are 30 days from first discovered until now().  If I add | where Days > 30, results show every event from the fiel. But I know they are there... anonymized query below. What am I doing wrong? Sample fields being eval'ed:  First Discovered: Jul 26, 2023 16:50:26 UTC Last Observed: Jul 19, 2024 09:06:32 UTC   index=stuff  source=file Severity="Critical" | lookup detail.csv "IP Address" OUTPUTNEW Manager | eval First_DiscoveredTS = strptime("First Discovered", "%b %d, %Y %H:%M:%S %Z"), Last_ObservedTS = strptime("Last Observed", "%b %d, %Y %H:%M:%S %Z"), firstNowDiff = (now() - First_DiscoveredTS)/86400, Days = floor(firstNowDiff) | stats by Manager | where Days > 30     ... View more

Dozens of posts on these topics.. I've tried makemv, fieldformat, tostring, tonumber all to no avail. So I'm just going to past my query in hopes someone can help me out. I have placed them after the stats call but having no luck.  query | stats list(Plugin) by Host, OS, App, Manager | rename list(Plugin) as "Plugin ID" The result is either one or several numbers in a single field - Plugin ID. I would prefer to delimit those results by comma (and align left for the single value results if possible).  Instead of (the lines are supposed to represent the cell/field): ______________ 204188 193574_______ ______193574__   I would like them on a single line, wrapping where necessary: 204188, 193574  193574_______   Any assistance would be appreciated.  ... View more

Hello, I'm struggling mightily with this one. I have two dates in the same event, both are strings.  Their format is below. I would like to evaluate the number of days between the firstSeen and lastSeen dates. I would also like to evaluate the number of days since firstSeen and when the search is performed. Any help would be much appreciated...    firstSeen: Aug 27, 2022 20:18:37 UTC lastSeen: Jun 23, 2024 06:17:25 UTC ... View more