Splunk Search

How to search the latest timestamp each user received their last email?

Mufu
Engager

Hi,
I need to search when (timestamp) each user has received the last email.
Is this possible?
I tried
to="<*@domain.com>" | stats count by to | sort -_time
but this does not seem to display the time...
sorry - I am pretty new to splunk...
TIA!
Mike

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

That should be pretty straightforward: make a stats with latest of whichever field you want to see the most recent of, in your case _time to get the timestamp. You end up with something this:

to="<*@allianz.co.uk>" | stats latest(_time) as time by user

If you want to display the timestamp in human readable format, use the following eval

to="<*@allianz.co.uk>" | stats latest(_time) as time by user | eval t=strftime(time, "%D - %H:%M:%S")

View solution in original post

splunker12er
Motivator
index=_internal *INFO* "sendemail:354"| stats latest(_time) as time by recipients | eval t=strftime(time, "%D - %H:%M:%S")
0 Karma

jeffland
SplunkTrust
SplunkTrust

That should be pretty straightforward: make a stats with latest of whichever field you want to see the most recent of, in your case _time to get the timestamp. You end up with something this:

to="<*@allianz.co.uk>" | stats latest(_time) as time by user

If you want to display the timestamp in human readable format, use the following eval

to="<*@allianz.co.uk>" | stats latest(_time) as time by user | eval t=strftime(time, "%D - %H:%M:%S")

Mufu
Engager

WHOA! That was quick! 😉
I just had to change
as time by user
to
as time by to
and that´s it!
Thank you so much!

Mike

0 Karma

splunker12er
Motivator

Did u able to view the results of email address by time, with the above query i posted ?

index=_internal INFO "sendemail:354"| stats values(_time) as time by recipients | eval t=strftime(time, "%D - %H:%M:%S")

OR

index=_internal INFO "sendemail:354"| eval t=strftime(_time, "%D - %H:%M:%S")|stats values(recipients) as Receipients by t

the above gets u address by time - for any specified time-range

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...