I'm trying to find the top 50 email senders. Is my search correct?

[seetharamanPr]

index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats values(sender) as sender by msg_id | eventstats dc(sender) as multi_sender by msg_id | where multi_sender > 50

We are have SMG in our company and it has been integrated successfully into Splunk as well. I am trying now to find out who are the top 50 email senders. Is the above search correct? If not, kindly let me know what has to be changed.

Regards
Pradeep

[alemarzu · Accepted solution]

Hi there @seetharamanPr

Try like this:

 index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats count by sender | sort - count | head 50

Hope it helps

[seetharamanPr]

Thank you alemarzu

the command works and I am able to see who is sending the most mails.

Regards
Pradeep

[alemarzu]

Nice, I'm glad it helped !