Hi,
I am pretty new to Splunk and been pouring over docs but not sure which direction to will resolve this for me. I would appreciate any help with getting the following search to display in a table format. The information is coming from a syslog feed that provides captive web portal information.
The search I am using is;
host="###.###.###.###" "First Name" OR "Last Name" OR Email OR "FollowUp=*"
The results look like this
6/13/14
7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: FollowUp=Yes host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14
7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: Email=xxxyyy@zzz.com host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14
7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: Last Name=yyy host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14
7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: First Name=xxx host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14 7:51:18.000 AM
What I would like to know is how do you group these by the timestamp / groups of these results (in case of simultaneous entries) to just show a table with the column headings of
Email Address | First Name | Last Name | Follow Up
Any help would be greatly appreciated.
If the timestamp seems to be the same for all 4 records, then try this. (assuming, fields are extracted as FollowUp,Email, Last_Name, First_Name)
host="###.###.###.###" "First Name" OR "Last Name" OR Email OR "FollowUp=*" | stats values(Email) as "Email Address",values(First_Name) as "First Name",values(Last_Name) as "Last Name",values(FollowUp) as "Follow Up"