Splunk Search

Format Email Direction and Count

RB5
Path Finder

Hi, am hoping for help with this. I want to format output as follows:

Domain      OUTBOUND_COUNT   INBOUND_COUNT  
xyz.COM                  24               16         

The best I can come up with is via the search below, but it gives:

 DIRECTION      DOMAIN      count  
 INBOUND        xyz.COM     26  
 OUTBOUND       xyz.COM     24 


index=dmzmail sourcetype=sendmail_syslog (process=extin* sender_domain=ml.com) OR (process=extout* recipient_domain=fortis.com) | head 50  | eval DIRECTION = case (direction=="inbound", "INBOUND", direction=="outbound", "OUTBOUND")| eval DOMAIN = case (sender_domain=="xyz.COM", "xyz.COM", recipient_domain=="xyz.COM", "xyz.COM")| stats count by DIRECTION, DOMAIN | table DIRECTION DOMAIN count

Thanks.

Tags (3)
0 Karma

RB5
Path Finder

I do not see where I can mark this as being answered. Also, odds are I'll never get this posted as it is impossible to read those dam 'CAPTCHA' phrases. I'm logged in, why don't you let me do a post instead of fighting over those captions. Personal Problem apparently.

0 Karma

linu1988
Champion

If worked please mark it as answer...

0 Karma

RB5
Path Finder

Thanks! Sorry, didn't know about the xyseries function, very convenient.

0 Karma

linu1988
Champion

Instead of table, xyseries will do it.

 index=dmzmail sourcetype=sendmail_syslog (process=extin sender_domain=ml.com) OR (process=extout recipient_domain=fortis.com) | head 50| eval DIRECTION = case direction=="inbound", "INBOUND", direction=="outbound", "OUTBOUND") | eval DOMAIN = case (sender_domain=="xyz.COM", "xyz.COM", recipient_domain=="xyz.COM", "xyz.COM")| stats count by DIRECTION, DOMAIN| stats count by DIRECTION, DOMAIN| xyseries DOMAIN DIRECTION count

Thanks

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...