Splunk Search

Need help formatting query output as needed

dhlevine
New Member

I have a set of mail logs and I need to generate output that shows daily counts of specific from or to addresses. This is what I'm using at the moment:

source="..." earliest="mm/dd/yyyy" latest="mm/dd/yyyy" from="@targetdomain" OR to="@targetdomain" | timechart span=1d count(from) AS dc(from) by from

This generates output of the form:

_time targetaddress1 targetaddress2 targetaddress3 ...
yyyy-mm-01 4 3 7
yyyy-mm-02 6 5 8

The format that I need to have is this:

_time address count
yyyy-mm-01 targetaddress1 4
yyyy-mm-01 targetaddress2 3
yyyy-mm-01 targetaddress3 7
yyyy-mm-02 targetaddress1 6
yyyy-mm-02 targetaddress2 5
yyyy-mm-02 targetaddress3 8

I'm fairly sure that there is a combination of timechart and/or table and/or some other feature that will allow me to do this but I'm a newbie to Splunk and I have some time constraints.

Any help would be appreciated.

Thanks!

Tags (1)
0 Karma
1 Solution

Arun_N_007
Communicator

Hi,

Why dont you use only stats.

First extract day from _time.

...|stats count by day,from|rename from as address

View solution in original post

0 Karma

Arun_N_007
Communicator

Hi,

Why dont you use only stats.

First extract day from _time.

...|stats count by day,from|rename from as address

0 Karma

dhlevine
New Member

Thank you! Adding a convert for the date in front resolved this question. Much appreciated!

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...