How to define minimum number of field values per event?

[evallja]

Hello everyone,

I have built a search that returns the email sender address as sender, its recipients list as recipient, and the number of emails received. One event looks like this:

sender                                                                        recipient                 nr of emails sent
user.sender@outsidecompany.com user1@company.com 16
                                                                          user2@company.com
                                                                         user3@company.com
                                                                         user4@company.com
                                                                         user5@company.com
                                                                         user6@company.com
                                                                         user7@company.com

I want to define the recipient field values to be 10 recipients or more because let's say I'm not interested to see outside emails from a sender that has sent an email to less than 10 people inside company.com.

Do you have any idea?

Best regards.

[somesoni2 · Accepted solution]

Add this to your current search

| where mvcount(recipient)>=10