Trying to work with data CDR's

[bcarlson]

Hello, I am new to Splunk and strugging with a report I am trying to generate for data CDR's.

what I am trying to accomplish is,

Search for CD's on specific domains (bob.com)

The CDR's contain the following fields;
date, domain, user, and total bytes used.

I am trying to create a table report that provides me the number of days a user was generating Data CDR's and how much data they used during each day. So that I can create something that looks like this.

Summary
Users that used data <5 days AND Total bytes used
Users that used data 6 to 10 days AND total bytes used
Users that used data 1 to 20 days AND total bytes used
Users that used data >20 days and the total bytes used.

any assitance would be appreciated.

thanks
Bob

[bcarlson]

I will re ask this question and include more information.
thanks
Bob

[bcarlson]

I am going to reask this question with the different information.
thanks
Bob

[bcarlson]

I am trying to add in some sample data, but haven't figured that out either.
thanks
Bob

[kristian_kolb]

without some sample events, it will be hard for anyone here to help you.