https://community.splunk.com/t5/Reporting/Detecting-spam/m-p/330016#M5954 <P>Perhaps this will get you started.</P> <PRE><CODE>&lt;your search for email&gt; | stats count(recipient) as recipients by Sender, Subject | where recipients &gt; 3 | ... </CODE></PRE> Fri, 13 Apr 2018 13:03:03 GMT richgalloway 2018-04-13T13:03:03Z https://community.splunk.com/t5/Reporting/Detecting-spam/m-p/330015#M5953 <P>Hi All,</P> <P>I'm creating a dashboard where it will show if 1 email is sent to multiple recipients (spam) - same sender, same subject, multiple recipients. So basically it's a threat detection via email. Is this possible?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4750i4DB66AE0AFECD190/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Cheers,<BR /> Bryan</P> Fri, 13 Apr 2018 08:27:20 GMT https://community.splunk.com/t5/Reporting/Detecting-spam/m-p/330015#M5953 bryansocito 2018-04-13T08:27:20Z https://community.splunk.com/t5/Reporting/Detecting-spam/m-p/330016#M5954 <P>Perhaps this will get you started.</P> <PRE><CODE>&lt;your search for email&gt; | stats count(recipient) as recipients by Sender, Subject | where recipients &gt; 3 | ... </CODE></PRE> Fri, 13 Apr 2018 13:03:03 GMT https://community.splunk.com/t5/Reporting/Detecting-spam/m-p/330016#M5954 richgalloway 2018-04-13T13:03:03Z