Splunk Search
Highlighted

How to count the number of recipients getting an email from a specific domain.

New Member

I have my search currently showing a count of one email to each user when I send a test email. I want to be able to total the number of recipients greater than or equal to 5 and filter on that.

my search currently shows this with a stats count;

subject     src_user      recipient
blah          blah           1
blah          blah           1
blah          blah           1
blah          blah           1
blah          blah           1

I want it to show me me the src_user and a number of recipients total from that specific email. I hope this makes sense.
Thanks.

0 Karma
Highlighted

Re: How to count the number of recipients getting an email from a specific domain.

Splunk Employee
Splunk Employee

You can use the count function to count events where the emails that have matching subject values, then use the where command to filter. For example:

.. | stats count by subject | where count>5

0 Karma
Highlighted

Re: How to count the number of recipients getting an email from a specific domain.

SplunkTrust
SplunkTrust

If you want to count by domain you need to extract the domain using regex and then count by that.

For instance (not tested in Splunk):

yoursearchhere | rex field=src_user "[\w][\w\-\.]+@(?<domain>\w[\w\-\.]+[a-zA-Z]{2,5})" | stats count by domain

Note there are better and more efficient regex patterns to match an email address, but the above is very easy to understand.
You can test you regex here: https://regex101.com/

Thanks,
J

Highlighted

Re: How to count the number of recipients getting an email from a specific domain.

Splunk Employee
Splunk Employee
... | stats count by subject src_user | where count >= 5 | rename count AS recipients

View solution in original post

0 Karma
Highlighted

Re: How to count the number of recipients getting an email from a specific domain.

New Member

Thanks a ton. This works how I wanted.

0 Karma