New comment on reddit

I think I understand what you're looking for … try something like this (note – I haven't tried it, just running off how I think it should approximately look):

index=ndx sourcetype=srctp owner=* doc_title=* doc_viz=* earliest=-7d | eval when=strftime(_time,"%c") | sort 0 owner when | eval dt_dv_w=doc_title+" "+doc_viz+" "+when | stats list(dt_dv_w) as dt_dv_w by owner | rex field=dt_dv_w "(?<doc_title>\w+)\s{4}(?<doc_viz>\w+)\s{4}(?<when>.+)" | fields - dt_dv_w | table owner doc_title doc-viz when 

Not sure if it'd be possible to prepend the item number (1,2,3…) before each value – but I think this'll get you close

June 03, 2020 at 09:13AM
via reddit https://www.reddit.com/r/Splunk/comments/gt6by8/alerting_on_last_specific_action/fsqs2ev?utm_source=ifttt