Splunk Search
Highlighted

Create report for different fields

New Member

Hi,
I have a search:

source="/var/log/mail.log" to="*mail.com"  OR from="*@mail.com"

How can i build report where i can see columns what show count of emails in day/hour, but the column has two colours, one colour for sent emails and other colour for recived emails.
And some statistics that in that day there were 100 emails 40of them recived and 60 sent.

Tags (2)
0 Karma
Highlighted

Re: Create report for different fields

Ultra Champion

Perhaps something like this could do. The visualization part is left as an exercise to the reader.

your_search | timechart span=1h c as total c(eval(like(to, "%mail.com"))) as sent_count c(eval(like(from, "%mail.com"))) as received_count 

/K

0 Karma