Help with search to make report?

[john8745]

Hi, dear splunkers, actually im new to splunk and I need to write a query in order to make a report. So, from a logs I have to display for several employees their first connection time for each day for a period of two weeks and have it in output.  As i see steps would be to take each day, find  time of earliest event and write it in output. How it would be better to implement it? Thanks in advance.

My draft

index=<insex_name> sourcetype=<source_name> earliest=-14d latest=-13d user@email | sort _time asc | head 1 | table _time, user | eval 25.05=strftime(_time,"%Y-%m-%dT%H:%M:%S.%Q") | fields - _time

[ITWhisperer]

You could start with something like this

index=<insex_name> sourcetype=<source_name> earliest=-14d@d latest=@d user@email 
| bin span=1d _time as day
| stats earliest(_time) as first by day user
| fieldformat first=strftime(first,"%Y-%m-%dT%H:%M:%S.%Q")