I have 3 reports that I want to put into one report, here is my search
sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=RECEIVE) user_bunit=Energy recipient_domain="IID.com"
| stats count as RECEIVE by recipient
|append
[search sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=SEND) user_bunit=Energy recipient_domain="IID.com" | stats count as SEND by recipient]
|table recipient, SEND, RECEIVE
The data I get is only the recipient and RECEIVE data, it does not display the SEND information
what I missing here
It seems like the answer should be clear, but I'm drawing a blank ATM. Try this variant, instead. BTW, you said 3 searches, but the query only does 2.
sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=RECEIVE OR event_id=SEND) user_bunit=Energy recipient_domain="IID.com"
| stats sum(eval(event_id=RECEIVE)) as RECEIVE, sum(eval(event_id=SEND)) by recipient
|table recipient, SEND, RECEIVE
This should run faster since it only makes one pass through the index (which you should specify).
It seems like the answer should be clear, but I'm drawing a blank ATM. Try this variant, instead. BTW, you said 3 searches, but the query only does 2.
sourcetype=MSExchange:*:MessageTracking source_id=SMTP (event_id=RECEIVE OR event_id=SEND) user_bunit=Energy recipient_domain="IID.com"
| stats sum(eval(event_id=RECEIVE)) as RECEIVE, sum(eval(event_id=SEND)) by recipient
|table recipient, SEND, RECEIVE
This should run faster since it only makes one pass through the index (which you should specify).
Hi,
Could you please provide a sample of your logs?
Based on the fields described in your search I created a sample file and could reach the results using the following query:
index=... source_id=SMTP (event_id=RECEIVE) user_bunit=Energy recipient_domain="IID.com"
| stats count as RECEIVE by recipient
| append
[ search index=... source_id=SMTP (event_id=SEND) user_bunit=Energy recipient_domain="IID.com"
| stats count as SEND by recipient]
| stats values(SEND) as SEND, values(RECEIVE) as RECEIVE by recipient
The was my output: