https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223988#M65975 <PRE><CODE>index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats values(sender) as sender by msg_id | eventstats dc(sender) as multi_sender by msg_id | where multi_sender &gt; 50 </CODE></PRE> <P>We are have SMG in our company and it has been integrated successfully into Splunk as well. I am trying now to find out who are the top 50 email senders. Is the above search correct? If not, kindly let me know what has to be changed. </P> <P>Regards<BR /> Pradeep</P> Wed, 28 Sep 2016 12:26:42 GMT seetharamanPr 2016-09-28T12:26:42Z https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223988#M65975 <PRE><CODE>index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats values(sender) as sender by msg_id | eventstats dc(sender) as multi_sender by msg_id | where multi_sender &gt; 50 </CODE></PRE> <P>We are have SMG in our company and it has been integrated successfully into Splunk as well. I am trying now to find out who are the top 50 email senders. Is the above search correct? If not, kindly let me know what has to be changed. </P> <P>Regards<BR /> Pradeep</P> Wed, 28 Sep 2016 12:26:42 GMT https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223988#M65975 seetharamanPr 2016-09-28T12:26:42Z https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223989#M65976 <P>Hi there @seetharamanPr</P> <P>Try like this:</P> <PRE><CODE> index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats count by sender | sort - count | head 50 </CODE></PRE> <P>Hope it helps</P> Wed, 28 Sep 2016 19:44:07 GMT https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223989#M65976 alemarzu 2016-09-28T19:44:07Z https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223990#M65977 <P>Thank you alemarzu</P> <P>the command works and I am able to see who is sending the most mails.</P> <P>Regards<BR /> Pradeep</P> Thu, 29 Sep 2016 04:58:19 GMT https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223990#M65977 seetharamanPr 2016-09-29T04:58:19Z https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223991#M65978 <P>Nice, I'm glad it helped !</P> Thu, 29 Sep 2016 12:32:20 GMT https://community.splunk.com/t5/Splunk-Search/I-m-trying-to-find-the-top-50-email-senders-Is-my-search-correct/m-p/223991#M65978 alemarzu 2016-09-29T12:32:20Z