Have a search that returns emails of interest (possibly malicious). Trying to add a subsearch that will return a count of how many times each sender address has been seen in the last 30 days (regardless of the timeframe used in the main search).
When using the search below, Splunk returns a "Error in eval command: Fields cannot be assigned a boolean result" error based on the eval command. The tstats command works fine independently.
index=proofpoint
| rex field=msg.header.reply-to{} ".*\<(?<Sender_Address>[a-zA-Z0-9\.\-\+]+@[a-zA-Z0-9\.\-]+)\>"
| eval Sender_Count=[ | tstats count where index=proofpoint TERM($Sender_Address$) earliest=-30d@m latest=now]
| table _time msg_header_from msg.header.reply-to{} Sender_Address Sender_Count
Don't worry about the sub-optimal email matching regex - just POC.
Tried appendcols, too, with no luck. Is this possible? Thank you
... View more
