About hattrells

hattrells · ‎11-25-2019

This was incredibly easy in the end.... your answer is pretty much what I was trying to get to, only I didn't want to see the count per recipient, only the overall count of distinct subject headers so: index="mail" | stats count by subject | search count>50 Added an alert which is only triggered when the count is greater than 50 🙂

hattrells · ‎11-25-2019

I have events coming in from an email spam appliance and would like to have an alert on spam campaigns with a unique sender,subject or content if they exceed a certain number (e.g. 50) I'm scratching my head trying to create a search to get a count of events with common value for the subject field as a start. index="mail" | stats dc(subject) as subjectcount | where subjectcount > 50

Posts	2
Solutions	0
Karma Given	0
Karma Received	1
Member Since	‎10-09-2018

Online Status	Offline
Date Last Visited	‎02-11-2021 04:57 PM

Count of distinct values for emails

Re: Count of distinct values for emails

Count of distinct values for emails