topic Re: How do I organize a table by time without altering other data? in Splunk Search

How do I organize a table by time without altering other data?

mab17 — Mon, 24 Jun 2013 14:00:43 GMT

I have a table with three columns displaying one with user names and two differing ones arranged by user names. I want to break each occurrence up by time without changing the current format. I am trying to run the search over the past 7 days and show the count, etc for each user each day. Can anybody help to show how to go about doing this? Thank you!

Re: How do I organize a table by time without altering other data?

okrabbe_splunk — Mon, 24 Jun 2013 15:28:35 GMT

Any chance you could post an example of your data format as well as how you would like it to be formatted?

Re: How do I organize a table by time without altering other data?

MHibbin — Mon, 24 Jun 2013 16:17:31 GMT

Not tested this, however, food for thought...

You can use convert to create time fields (e.g. day of the week). Perhaps something like...

.. | convert timeformat="%A" ctime(_time) as weekday

Then you can do your stats using that field and the user field.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Convert
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Commontimeformatvariables