When a user is added i need the time to be recorded and displayed in a field called used_added. I created the field name and can see if in the csv table but there is no time per entry.
<query>
| inputlookup USB.csv
| eval user_added = strftime(_time, "%Y-%d-%m %H:%M:%S")
| append [ | makeresults
| eval user="$user_tok$", description="$description_tok$", revisit="$revisit_tok$", Action="$dropdown_tok$" ]
| fields - _time
| table user_added, user_added, user, category, department, description, revisit, status
| lookup lookup_ims user as user OUTPUT category department
| outputlookup USB.csv
</query>
The user_added field is in a separate event from the other fields because of the append command. What's more, I believe the _time field will be null since there is no event with such a field when user_added is defined. Consider using now(), instead.
The user_added field is in a separate event from the other fields because of the append command. What's more, I believe the _time field will be null since there is no event with such a field when user_added is defined. Consider using now(), instead.