Hi, dear splunkers, actually im new to splunk and I need to write a query in order to make a report. So, from a logs I have to display for several employees their first connection time for each day for a period of two weeks and have it in output. As i see steps would be to take each day, find time of earliest event and write it in output. How it would be better to implement it? Thanks in advance.
My draft
index=<insex_name> sourcetype=<source_name> earliest=-14d latest=-13d user@email | sort _time asc | head 1 | table _time, user | eval 25.05=strftime(_time,"%Y-%m-%dT%H:%M:%S.%Q") | fields - _time
You could start with something like this
index=<insex_name> sourcetype=<source_name> earliest=-14d@d latest=@d user@email
| bin span=1d _time as day
| stats earliest(_time) as first by day user
| fieldformat first=strftime(first,"%Y-%m-%dT%H:%M:%S.%Q")