i require some assistance in my search query where i need to search a mail log to extract the highest recipients by message size based upon a unique common id.
as i am able to search events by the size field to see the values of message size from the senders addresses but i am unable to search this by the recipients address including to show the unique ID.
so i need to combine these two events first showing the message size and then the recipient addresses based upon a common queue ID. i know the stats function is more beneficial than the transaction command as it is costly. Also i believe i am able to chart it through xyseries but i'm unsure how to put this together as i have tried a various types of stats commands trying to put this together but i have a strong feeling i'm not executing it correctly
Did you try
stats values(recipient ) as recipient ,values(senders) as senders,max(message_size) by unqiue_id
If its not working, would it be possible to share some sample events after masking any sensitive data?
| stats values(from) as senders ,values(to) as recipients,max(size) as "Message SIze" by qid
| rename qid as "Unique ID"
| sort 10 -"Message Size"