Hi,
I have a search as below. I want to find count of recipients by action where how many users received the email vs not for every event
index=a sourcetype="a"
| bucket span=4h _time
| stats values(action) as email_action,values(Sender) as Sender,dc(sender_email) as Sender_email_count,values(subject) as subject,dc(URL) as url_count, values(URL) as urls,values(filename) as files,values(recipients_list) as recipients_list by sender_name,_time
| search (subject="*RE:*")
Any help would be appreciated.. thank you!
| stats dc(sender_email) as Sender_email_count by action
Is this what you are after?
If not, please provide some anonymised sample events and some expected output to clarify your requirement