Splunk Search

How to find count of recipients by action where how many users received the email vs not for every event?

Woodpecker
Path Finder

Hi,

I have a search as below. I want to find count of recipients by action where how many users received the email vs not for every event

 

index=a sourcetype="a" 
| bucket span=4h _time
| stats values(action) as email_action,values(Sender) as Sender,dc(sender_email) as Sender_email_count,values(subject) as subject,dc(URL) as url_count, values(URL) as urls,values(filename) as files,values(recipients_list) as recipients_list by sender_name,_time 
| search (subject="*RE:*")

 

 Any help would be appreciated.. thank you!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats dc(sender_email) as Sender_email_count by action

Is this what you are after?

If not, please provide some anonymised sample events and some expected output to clarify your requirement

0 Karma
Get Updates on the Splunk Community!

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...

New Splunk Innovations Enhance Performance and Accelerate Troubleshooting

Splunk is excited to announce new releases that empower ITOps and engineering teams to stay ahead in ever ...