Hi, dear splunkers, actually im new to splunk and I need to write a query in order to make a report. So, from a logs I have to display for several employees their first connection time for each day for a period of two weeks and have it in output.  As i see steps would be to take each day, find  time of earliest event and write it in output. How it would be better to implement it? Thanks in advance. My draft index=<insex_name> sourcetype=<source_name> earliest=-14d latest=-13d user@email | sort _time asc | head 1 | table _time, user | eval 25.05=strftime(_time,"%Y-%m-%dT%H:%M:%S.%Q") | fields - _time ... View more