topic Trying to work with data CDR's in Getting Data In

Trying to work with data CDR's

bcarlson — Thu, 02 May 2013 19:38:30 GMT

Hello, I am new to Splunk and strugging with a report I am trying to generate for data CDR's.

what I am trying to accomplish is,

Search for CD's on specific domains (bob.com)

The CDR's contain the following fields;
date, domain, user, and total bytes used.

I am trying to create a table report that provides me the number of days a user was generating Data CDR's and how much data they used during each day. So that I can create something that looks like this.

Summary
Users that used data <5 days AND Total bytes used
Users that used data 6 to 10 days AND total bytes used
Users that used data 1 to 20 days AND total bytes used
Users that used data >20 days and the total bytes used.

any assitance would be appreciated.

thanks
Bob

Re: Trying to work with data CDR's

kristian_kolb — Thu, 02 May 2013 20:32:16 GMT

without some sample events, it will be hard for anyone here to help you.

Re: Trying to work with data CDR's

bcarlson — Thu, 02 May 2013 22:16:00 GMT

I am trying to add in some sample data, but haven't figured that out either.
thanks
Bob

Re: Trying to work with data CDR's

bcarlson — Fri, 03 May 2013 21:12:28 GMT

I am going to reask this question with the different information.
thanks
Bob

Re: Trying to work with data CDR's

bcarlson — Fri, 03 May 2013 21:13:15 GMT

I will re ask this question and include more information.
thanks
Bob