Splunk Search

How do I organize a table by time without altering other data?

mab17
New Member

I have a table with three columns displaying one with user names and two differing ones arranged by user names. I want to break each occurrence up by time without changing the current format. I am trying to run the search over the past 7 days and show the count, etc for each user each day. Can anybody help to show how to go about doing this? Thank you!

Tags (2)
0 Karma

MHibbin
Influencer

Not tested this, however, food for thought...

You can use convert to create time fields (e.g. day of the week). Perhaps something like...

.. | convert timeformat="%A" ctime(_time) as weekday

Then you can do your stats using that field and the user field.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Convert
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Commontimeformatvariables

0 Karma

okrabbe_splunk
Splunk Employee
Splunk Employee

Any chance you could post an example of your data format as well as how you would like it to be formatted?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...