Update Time Field for a User on Table

aquinojason — Thu, 17 Jun 2021 12:36:30 GMT

Hi,

I am making a report that needs to identify how long long since a user launch an application. Can I use splunk to do this instead?

We have a tool that can generate the Username Fullname

I am thinking to add the "date" of when the report was generated as "last used date"

so the file would look like:

user123,fullusername,dateofreport

and by the next time (after a week), if the user exists on the table, the dateofreport would be updated.

and then after 3 months or so of data, I need to generate another report of the users who didn't open the application for the last 3 months.

Thanks for the help.

Re: Update Time Field for a User on Table

ITWhisperer — Thu, 17 Jun 2021 12:55:43 GMT

Something like this?

| stats last(dateofreport) as lastreport by userid

aquinojason — Thu, 17 Jun 2021 13:07:29 GMT

Hi,

Thanks for the idea. I'll test this one.

Regards,