Hi, I believe the first step for you is to start extracting fields from your log, for our luck a lot of common log sources already have field extractions already built into Splunk or either available from Splunk add-ons. What exactly is the log source you're trying to create your report? You might also want to look inside https://splunkbase.splunk.com/ to check for any add-ons that might help you. If no add-on is available or you're looking into a quite custom log source you'll need to extract fields yourself. This task can be achieved either by creating REGEXES or using the built-in Splunk field extractor. A good start is to use this documentation that helps you extracting fields: https://docs.splunk.com/Documentation/Splunk/8.0.1/Knowledge/ExtractfieldsinteractivelywithIFX. If you don't know a lot of REGEX, the built-in field extractor is good enough. Now assuming you have your data indexed and fields extracted the next part is to start filtering data with Splunk. We can probably help you creating a few searches but it is very dependant on your data. I highly recommend you taking the Free Splunk courses, Foundamentals is a very good starting point: https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html. Hope this helps you with your beginning with Splunk and happy splunking 🙂 ... View more