How to generate a search to sort based on domain names and count the number of emails from the domain?

[rvinjana]

i have a search with multiple domains in the email address , i need to sort it based on domain names and number of emails from the domain . here is the output from from which i need to sort

source email id , destination email id , email subject . 

count emails based on domain of the source email

[DalJeanis · Accepted solution]

(your base search that results in one record per email with source, dest and subject...) 
| table EmailSource EmailDest EmailSubject
| rex field=EmailSource "[^@]*@(?<DomainSource>.*)"
| fillnull DomainSource value="((Domain not found))"
| eventstats count as DomainCount by DomainSource
| sort 0 -DomainCount DomainSource EmailSource
| table DomainSource DomainCount EmailSource EmailDest EmailSubject

Ans a run-anywhere search with some test data to prove out the above code...

| makeresults 
| eval mydata="junkemail,dest1@dest.com,Test Bad Email!!!!bill2@gates.com,dest2@dest2.com,Pay Me Now!!!!bill1@gates.com,dest3@dest2.com,Pay Me Now!!!!bill1@gates.com,dest4@dest4.com,Pay Me Now Or Else!!!!steve@apple.com,everybody@world.com,I Am Risen Because It's Cool" 
| makemv delim="!!!!" mydata 
| mvexpand mydata 
| makemv delim="," mydata
| eval EmailSource=mvindex(mydata,0),  EmailDest=mvindex(mydata,1), EmailSubject=mvindex(mydata,2)
| table EmailSource EmailDest EmailSubject

[rvinjana]

this is awesome thanks a lot

[asimagu]

have you created the field extractions for your data?

[naidusadanala]

can you post your existing spl ?