Update Time Field for a User on Table

[aquinojason]

Hi,

I am making a report that needs to identify how long long since a user launch an application. Can I use splunk to do this instead?

We have a tool that can generate the Username Fullname 

I am thinking to add the "date" of when the report was generated as "last used date"

so the file would look like:

user123,fullusername,dateofreport

and by the next time (after a week), if the user exists on the table, the dateofreport would be updated.

and then after 3 months or so of data, I need to generate another report of the users who didn't open the application for the last 3 months.

Thanks for the help.

[ITWhisperer]

Something like this?

| stats last(dateofreport) as lastreport by userid

[aquinojason]

Hi,

Thanks for the idea. I'll test this one.

Regards,