https://community.splunk.com/t5/Reporting/Email-Trending/m-p/151476#M3358 <P>The base search is returning results right? </P> <PRE><CODE>index=msexchange Username="*" </CODE></PRE> <P>Then this should work: </P> <PRE><CODE>index=msexchange Username="*"| timechart partial=f fixedrange=f limit=0 span=30d count by Username </CODE></PRE> Fri, 22 Nov 2013 00:05:52 GMT chris 2013-11-22T00:05:52Z https://community.splunk.com/t5/Reporting/Email-Trending/m-p/151475#M3357 <P>Hello everyone,</P> <P>I am a newbie so please dont hurt me! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> However, I need to get a report using trending (30 days) on email per usernames.. </P> <P>index=msexchange Username="*" | timechart partial=f fixedrange=f limit=0 span=30d sum(count) by Username</P> <P>It does not work.. Can some one assist me on Splunk?</P> <P>Thanks</P> Thu, 21 Nov 2013 20:55:46 GMT https://community.splunk.com/t5/Reporting/Email-Trending/m-p/151475#M3357 leecwise 2013-11-21T20:55:46Z https://community.splunk.com/t5/Reporting/Email-Trending/m-p/151476#M3358 <P>The base search is returning results right? </P> <PRE><CODE>index=msexchange Username="*" </CODE></PRE> <P>Then this should work: </P> <PRE><CODE>index=msexchange Username="*"| timechart partial=f fixedrange=f limit=0 span=30d count by Username </CODE></PRE> Fri, 22 Nov 2013 00:05:52 GMT https://community.splunk.com/t5/Reporting/Email-Trending/m-p/151476#M3358 chris 2013-11-22T00:05:52Z