You should adjust the following query based on the index and sourcetype of your email data.
If you don't have extracted fields, you can just list the email addresses on the first line.
[email protected] [email protected]
earliest="9/20/2021:17:00:00" latest="9/20/2021:18:00:00"
| stats count by sender_field, recipient_field, status
Alternatively, you can schedule an alert to run with a cron schedule of 5 18 * * * with an earliest -65m@m and latest of -5m@m.
The status is the field that advises of success or failure. If this is not present, you can extract it using something like
| rex field=_raw "<text before status>(?<status>[^\s]+)"
This will extract one or more characters after the specified text up until the next space.
