How to count the number of recipients getting an email from a specific domain.

[Mitchellsch]

I have my search currently showing a count of one email to each user when I send a test email. I want to be able to total the number of recipients greater than or equal to 5 and filter on that.

my search currently shows this with a stats count;

subject     src_user      recipient
blah          blah           1
blah          blah           1
blah          blah           1
blah          blah           1
blah          blah           1

I want it to show me me the src_user and a number of recipients total from that specific email. I hope this makes sense.
Thanks.

[dcarmack_splunk · Accepted solution]

... | stats count by subject src_user | where count >= 5 | rename count AS recipients

[Mitchellsch]

Thanks a ton. This works how I wanted.

[javiergn]

If you want to count by domain you need to extract the domain using regex and then count by that.

For instance (not tested in Splunk):

yoursearchhere | rex field=src_user "[\w][\w\-\.]+@(?<domain>\w[\w\-\.]+[a-zA-Z]{2,5})" | stats count by domain

Note there are better and more efficient regex patterns to match an email address, but the above is very easy to understand.
You can test you regex here: https://regex101.com/

Thanks,
J

[jluo_splunk]

You can use the count function to count events where the emails that have matching subject values, then use the where command to filter. For example:

.. | stats count by subject | where count>5