Splunk Search

I'm trying to find the top 50 email senders. Is my search correct?

seetharamanPr
New Member
index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats values(sender) as sender by msg_id | eventstats dc(sender) as multi_sender by msg_id | where multi_sender > 50

We are have SMG in our company and it has been integrated successfully into Splunk as well. I am trying now to find out who are the top 50 email senders. Is the above search correct? If not, kindly let me know what has to be changed.

Regards
Pradeep

0 Karma
1 Solution

alemarzu
Motivator

Hi there @seetharamanPr

Try like this:

 index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats count by sender | sort - count | head 50

Hope it helps

View solution in original post

0 Karma

alemarzu
Motivator

Hi there @seetharamanPr

Try like this:

 index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats count by sender | sort - count | head 50

Hope it helps

0 Karma

seetharamanPr
New Member

Thank you alemarzu

the command works and I am able to see who is sending the most mails.

Regards
Pradeep

0 Karma

alemarzu
Motivator

Nice, I'm glad it helped !

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...