Below is my report but my date output is blank, i am searching for powershell events on my network and need to know what date these events occurred, any suggestions?
sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1" | stats count as Event_Count values(user) as User values(computer_name) as Computer_Name values(category) as Category values(application_name) as Application_Name values(strftime(_time, "%d/%m/%Y")) as Time by ip_address| sort -Event_Count _time
Thanks much.
Try this:
sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1"
| stats count as Event_Count list(user) as User list(computer_name) as Computer_Name list(category) as Category list(application_name) as Application_Name list(eval(strftime(_time, "%d/%m/%Y"))) as Time by ip_address
| sort -Event_Count _time
Try this:
sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1"
| stats count as Event_Count list(user) as User list(computer_name) as Computer_Name list(category) as Category list(application_name) as Application_Name list(eval(strftime(_time, "%d/%m/%Y"))) as Time by ip_address
| sort -Event_Count _time
I've had mixed results using eval
within stats
so I would use a separate eval
.
sourcetype="symantec:ep:risk:file" index=security_sep application_name ="*.ps1" | eval Time=strftime(_time, "%d/%m/%Y") | stats count as Event_Count values(user) as User values(computer_name) as Computer_Name values(category) as Category values(application_name) as Application_Name values(Time) as Time by ip_address| sort -Event_Count Time
add eval into your Time command.
values(eval(strftime(_time, "%d/%m/%Y"))) as Time
Your stats search named the values() function output Time, so _time isn't available. Try changing your sort to:
sort -Event_Count Time
Or change your values() function to name the field _time.
Edit: and change your values() function to use eval(), as per the answer below.