Splunk:Reports:Slack - lbonanomi/notes GitHub Wiki

Generate a table of user-X inviting user-Y into channel-Z for whatever the specified search period is:

index="slack" action=user_channel_join | spath output=user path=actor.user.email |
spath output=channel path=entity.channel.name |
spath output=how path=details.type |
where how="INVITED" |
spath output=when path=date_create |
spath output=by path=details.inviter.email |
eval join_time=strftime(when,"%m/%d/%y %H:%M:%S") |
table user,join_time,channel,how,by