generating 5 individual notables events for single search but i need one notable event for all the search results

[vikkysplunk]

Hi all,

Using the below SPL i have created one new use case for multiple emails sent from external domain. For example if i get 5 results in search it is generating 5 individual notables events but i need one notable event for all the 5 results .. pls could you help me on these

index=msexchange sourcetype=MSExchange*:MessageTracking tag=email action=delivered sender_domain!=@x.x.x recipients!=@x.x.x | stats dc(recipient) as count by sender | search count >=4 | rename count as recipient_count | table sender recipient_count

Search Range 1hr

Cron schedule : */5 * * * *

[ITWhisperer · Accepted solution]

Your count appears to be by sender not sender_domain, could that be why?