I have a set of mail logs and I need to generate output that shows daily counts of specific from or to addresses. This is what I'm using at the moment:
source="..." earliest="mm/dd/yyyy" latest="mm/dd/yyyy" from="@targetdomain" OR to="@targetdomain" | timechart span=1d count(from) AS dc(from) by from
This generates output of the form:
_time targetaddress1 targetaddress2 targetaddress3 ...
yyyy-mm-01 4 3 7
yyyy-mm-02 6 5 8
The format that I need to have is this:
_time address count
yyyy-mm-01 targetaddress1 4
yyyy-mm-01 targetaddress2 3
yyyy-mm-01 targetaddress3 7
yyyy-mm-02 targetaddress1 6
yyyy-mm-02 targetaddress2 5
yyyy-mm-02 targetaddress3 8
I'm fairly sure that there is a combination of timechart and/or table and/or some other feature that will allow me to do this but I'm a newbie to Splunk and I have some time constraints.
Any help would be appreciated.
Thanks!
Hi,
Why dont you use only stats.
First extract day from _time.
...|stats count by day,from|rename from as address
Hi,
Why dont you use only stats.
First extract day from _time.
...|stats count by day,from|rename from as address
Thank you! Adding a convert for the date in front resolved this question. Much appreciated!