There may be more elegant ways to achieve this, but here is perhaps one way:
(item 0 of it as string & " " & item 1 of it as string) of (date (universal time zone) of it, time (universal time zone) of it) of (subscribe time of site "actionsite")
The ‘as universal string’ cast may be helpful as well
q: (subscribe time of site "actionsite")
A: Thu, 05 Jan 2023 20:37:56 -0600
T: 0.124 ms
I: singular time
q: (subscribe time of site "actionsite") as universal string
A: Fri, 06 Jan 2023 02:37:56 +0000
T: 0.059 ms
I: singular string
Q: (format "{1}-{2}-{0} {3}" + (day_of_month of (it as universal date) as string) + (year of (it as universal date) as string) + (month of (it as universal date) as two digits) + (time (universal time zone) of it) as string) of (subscribe time of site "actionsite")
A: 2020-12-28 17:39:43 +0000
Definitely unwieldy, but you can arrange the output to match your reporting requirements. This example allows easy sorting in the console. Another approach would be to place a delimiter between the format variables so you could parse it into columns in excel. I would recommend a pipe symbol | or the tilde ~, so you don’t have to futz with the presence of commas, should you change the outputs. Spaces would work also if you don’t care about the time zone value.
Ultimately we want First Report Time to be provided by HCL as the idea states. I would have to say first time a machine is seen is just as important if not more than last report time.
Just FYI, using subscribe time of site as relevance to detect when machine has first reported in is not always accurate. It is depending on a file (SiteData.db) under __BESData folder which is not the more secure place and do require clean-up as part as some troubleshooting activities. Also, found a bug recently with support as to when this particular sqlite db is corrupt the agent can’t recover by itself and just resubscribes all sites on every agent restart making the inspector unreliable. The KB0118308 is now assigned to 11.0.4 (there is also hotfix within 11.0.3) but as an alternative what we’ve tested with Support to detect first report in is using the certificate request file which normally doesn’t change even when client certs are re-created (upgrade to 11.0.3 and above apparently does recreate certs by putting machines FQDN but appart from that it does look more stable workaround at least in our environment:
modification time of file "SiteData.db" of data folder of client
Note that the Console treats all the property results as strings with the exception of a couple like ‘Last Report Time’ that are specifically coded to sort as time types.
‘First Check-In’ will be treated as a string, so be sure to zero-pad the months else “10”, “11”, and “12” will sort before “2”, “3”, etc.