Hi,
I have the following problem and am wondering if this is a bug or am I doing something wrong:
I use a scheduled search to find some events with a specific windows error ID. Then I look at it as a table using:
|table _time,
No I created a scheduled search based on that, where I send the result as an email with a csv-attachment.
In the csv-attachment (as opposed to the interactive version) I get the _time column filled in epoch (seconds since 1970) format instead of a human readable form that I get in the search app. Is this a bug or do I have to do something to make this work properly. Everything on 5.0.3.
Cheers,
Konstantin
... View more