Hi,
I am pretty new to Splunk and been pouring over docs but not sure which direction to will resolve this for me. I would appreciate any help with getting the following search to display in a table format. The information is coming from a syslog feed that provides captive web portal information.
The search I am using is;
host="###.###.###.###" "First Name" OR "Last Name" OR Email OR "FollowUp=*"
The results look like this
6/13/14
7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: FollowUp=Yes host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14
7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: Email=xxxyyy@zzz.com host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14
7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: Last Name=yyy host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14
7:54:36.000 AM
Jun 13 07:54:36 ###.###.###.### ah_auth: First Name=xxx host = ###.###.###.### source = Syslog 10514 sourcetype = syslog 6/13/14 7:51:18.000 AM
What I would like to know is how do you group these by the timestamp / groups of these results (in case of simultaneous entries) to just show a table with the column headings of
Email Address | First Name | Last Name | Follow Up
Any help would be greatly appreciated.
... View more