This just goes to show how important it is to illustrate your data (with proper sanitization) before asking a question. The raw log you showed contains very few fields used in your illustrated codes. If this is the real data format and the search codes are the real ones you tried, how can you expect the code to do anything? Strictly using the data you illustrated, assuming it is the exact format that Splunk ingests, Splunk would have already extracted (flattened) all JSON nodes to respective fields, namely FromIP, MessageId, Organization, Received, RecipientAddress, SenderAddress, Size, Status, Subject, and ToIP. The data contains no array. So, all fields are single value. The JSON also has no nested nodes. So, all fields are flat. To achieve your illustrated output, all you need to do is to extract SenderDomain from SenderAddress, then stats on _time to get earliest and latest, i.e., | rex field=RecipientAddress "[^@]@(?<RecipientDomain>.+)"
| stats min(_time) as Earliest max(_time) as Latest by RecipientDomain SenderAddress RecipientAddress Subject
| convert ctime(Earliest), ctime(Latest) So, I didn't bother to rename RecipientAddress as recipient, SenderAddress as sender. But you already know how to do that if that is desirable. This, of course, is a far cry from the original problem statement. I suspect that there are some additions to the search. But at least the search should match real data.
... View more
