I have a set of mail logs and I need to generate output that shows daily counts of specific from or to addresses. This is what I'm using at the moment:
source="..." earliest="mm/dd/yyyy" latest="mm/dd/yyyy" from="@targetdomain" OR to="@targetdomain" | timechart span=1d count(from) AS dc(from) by from
This generates output of the form:
_time targetaddress1 targetaddress2 targetaddress3 ...
yyyy-mm-01 4 3 7
yyyy-mm-02 6 5 8
The format that I need to have is this:
_time address count
yyyy-mm-01 targetaddress1 4
yyyy-mm-01 targetaddress2 3
yyyy-mm-01 targetaddress3 7
yyyy-mm-02 targetaddress1 6
yyyy-mm-02 targetaddress2 5
yyyy-mm-02 targetaddress3 8
I'm fairly sure that there is a combination of timechart and/or table and/or some other feature that will allow me to do this but I'm a newbie to Splunk and I have some time constraints.
Any help would be appreciated.