Timestamps in a Data Table widget

[mmurdock (Mark M.)]

My goal is fairly simple: to display some fields from events in a Data Table and to also include the timestamp that they occurred. For example, if the event happened once for a user there would be one entry for that username and it would show the timestamp when it occurred. If there were two events for that user, then there would be two timestamps, etc.

Here’s an example of three events for a particular user:

So I create a Data Table, and add the username field, another related field, and the event timestamp. But instead of showing three events, what seems to happen is that I get many timestamps:

I have tried double-clicking the timestamp field and turning off Automatic interval (and setting it to seconds) but that just gives me more timestamp entries in the table. I believe I must be missing something obvious here and I’m just setting this up incorrectly. Any advice on this?

Thanks,
Mark

[shoothub]

Maybe search criteria for user field existance in widget could help: _exists_:asa_vpn_username

[mmurdock (Mark M.)]

I was thinking the same, and tried that, but still get a long list of timestamps for some users:

And from this you can see that user only has 2 events: