Create report for different fields

[ttrumm]

Hi,
I have a search:

source="/var/log/mail.log" to="*mail.com"  OR from="*@mail.com"

How can i build report where i can see columns what show count of emails in day/hour, but the column has two colours, one colour for sent emails and other colour for recived emails.
And some statistics that in that day there were 100 emails 40of them recived and 60 sent.

[kristian_kolb]

Perhaps something like this could do. The visualization part is left as an exercise to the reader.

your_search | timechart span=1h c as total c(eval(like(to, "%mail.com"))) as sent_count c(eval(like(from, "%mail.com"))) as received_count 

/K