Splunk Search

Need help formatting query output as needed

New Member

I have a set of mail logs and I need to generate output that shows daily counts of specific from or to addresses. This is what I'm using at the moment:

source="..." earliest="mm/dd/yyyy" latest="mm/dd/yyyy" from="@targetdomain" OR to="@targetdomain" | timechart span=1d count(from) AS dc(from) by from

This generates output of the form:

_time targetaddress1 targetaddress2 targetaddress3 ...
yyyy-mm-01 4 3 7
yyyy-mm-02 6 5 8

The format that I need to have is this:

_time address count
yyyy-mm-01 targetaddress1 4
yyyy-mm-01 targetaddress2 3
yyyy-mm-01 targetaddress3 7
yyyy-mm-02 targetaddress1 6
yyyy-mm-02 targetaddress2 5
yyyy-mm-02 targetaddress3 8

I'm fairly sure that there is a combination of timechart and/or table and/or some other feature that will allow me to do this but I'm a newbie to Splunk and I have some time constraints.

Any help would be appreciated.

Thanks!

Tags (1)
0 Karma
1 Solution

Communicator

Hi,

Why dont you use only stats.

First extract day from _time.

...|stats count by day,from|rename from as address

View solution in original post

0 Karma

Communicator

Hi,

Why dont you use only stats.

First extract day from _time.

...|stats count by day,from|rename from as address

View solution in original post

0 Karma

New Member

Thank you! Adding a convert for the date in front resolved this question. Much appreciated!

0 Karma