Hello all I'm having difficulties figuring out how to output 2 seperate counts for 2 seperate fields.
index=email spf="fail*" OR dkim="fail*"
| dedup message_id
| stats count BY spf, dkim
Atttempting to return a single count of the unique logs that contain spf="fail" and a single count of unique logs that contain dkim="fail" :
... View more