I have a table with three columns displaying one with user names and two differing ones arranged by user names. I want to break each occurrence up by time without changing the current format. I am trying to run the search over the past 7 days and show the count, etc for each user each day. Can anybody help to show how to go about doing this? Thank you!
Not tested this, however, food for thought...
You can use convert
to create time fields (e.g. day of the week). Perhaps something like...
.. | convert timeformat="%A" ctime(_time) as weekday
Then you can do your stats using that field and the user field.
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Convert
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Commontimeformatvariables
Any chance you could post an example of your data format as well as how you would like it to be formatted?