How do I organize a table by time without altering other data?

[mab17]

I have a table with three columns displaying one with user names and two differing ones arranged by user names. I want to break each occurrence up by time without changing the current format. I am trying to run the search over the past 7 days and show the count, etc for each user each day. Can anybody help to show how to go about doing this? Thank you!

[MHibbin]

Not tested this, however, food for thought...

You can use convert to create time fields (e.g. day of the week). Perhaps something like...

.. | convert timeformat="%A" ctime(_time) as weekday

Then you can do your stats using that field and the user field.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Convert
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Commontimeformatvariables

[okrabbe_splunk]

Any chance you could post an example of your data format as well as how you would like it to be formatted?