Need help formatting query output as needed

[dhlevine]

I have a set of mail logs and I need to generate output that shows daily counts of specific from or to addresses. This is what I'm using at the moment:

source="..." earliest="mm/dd/yyyy" latest="mm/dd/yyyy" from="@targetdomain" OR to="@targetdomain" | timechart span=1d count(from) AS dc(from) by from

This generates output of the form:

_time targetaddress1 targetaddress2 targetaddress3 ...
yyyy-mm-01 4 3 7
yyyy-mm-02 6 5 8

The format that I need to have is this:

_time address count
yyyy-mm-01 targetaddress1 4
yyyy-mm-01 targetaddress2 3
yyyy-mm-01 targetaddress3 7
yyyy-mm-02 targetaddress1 6
yyyy-mm-02 targetaddress2 5
yyyy-mm-02 targetaddress3 8

I'm fairly sure that there is a combination of timechart and/or table and/or some other feature that will allow me to do this but I'm a newbie to Splunk and I have some time constraints.

Any help would be appreciated.

Thanks!

[Arun_N_007 · Accepted solution]

Hi,

Why dont you use only stats.

First extract day from _time.

...|stats count by day,from|rename from as address

[dhlevine]

Thank you! Adding a convert for the date in front resolved this question. Much appreciated!