I have my search currently showing a count of one email to each user when I send a test email. I want to be able to total the number of recipients greater than or equal to 5 and filter on that.
my search currently shows this with a stats count;
subject src_user recipient
blah blah 1
blah blah 1
blah blah 1
blah blah 1
blah blah 1
I want it to show me me the src_user and a number of recipients total from that specific email. I hope this makes sense.
Thanks.
... | stats count by subject src_user | where count >= 5 | rename count AS recipients
... | stats count by subject src_user | where count >= 5 | rename count AS recipients
Thanks a ton. This works how I wanted.
If you want to count by domain you need to extract the domain using regex and then count by that.
For instance (not tested in Splunk):
yoursearchhere | rex field=src_user "[\w][\w\-\.]+@(?<domain>\w[\w\-\.]+[a-zA-Z]{2,5})" | stats count by domain
Note there are better and more efficient regex patterns to match an email address, but the above is very easy to understand.
You can test you regex here: https://regex101.com/
Thanks,
J
You can use the count function to count events where the emails that have matching subject values, then use the where command to filter. For example:
.. | stats count by subject | where count>5