Since a picture speaks a thousand words here is what my current results get me: As you can search my search gets me Date, Leased IP, and Host Name I would like the Date field to contain only the date i.e 08/24/2016 and not the hour, minute and second. Is there a way to do that? Thanks for any help you can throw my way, P. ... View more

I have this search that I run looking back at the last 30 days index = ib_dhcp_lease_history dhcpd OR dhcpdv6 r - l - e ACTION = Issued LEASE_IP = 10.* jdoe* Which tells me how many times jdoe got an IP address from my DHCP server. In this case, the DHCP server is an Infoblox box. The results are fine, except some days jdoe gets the same IP issued several times. The goal is to see just one event per day and what IP jdoe got. I tried dedup LEASE_IP, but that doesn't give me the real picture because there are days when he gets the same IP and it is as though he didn't get one from the results. I have also tried | sort date_mday and then the dedup and the same result. Then I tried to do | bucket spa n and that was no help either. I also tried | sort +_time | dedup LEASE_IP But that only gives me the latest results and leaves out days when he got an IP, but it was the same as other days. This is my first post and I really did look around first, but I am pretty green with SPLUNK. All help is much appreciated. P. ... View more