"number of scan:" | convert timeformat="%Y-%m-%d" ctime(_time) AS date | table source, date, Event
there is no event column which i think is search result
I am not sure but if you need to show raw event data you should use _raw. Also if you just want to format time differently you should use fieldformat.
Try the following search :
<YourBaseSearch>
| fieldformat _time=strftime(_time,"%Y-%m-%d")
| table source, date, _raw
PS: if your intent is to group events together by day you should use timechart command to aggregate the data.
this is it, really thanks
@cyberportnoc, I have converted to answer. Please accept.