Hello all I'm having difficulties figuring out how to output 2 seperate counts for 2 seperate fields.
index=email spf="fail" OR dkim="fail" | dedup message_id | stats count BY spf, dkim
Atttempting to return a single count of the unique logs that contain spf="fail" and a single count of unique logs that contain dkim="fail" :
spf dkim 14 75
... View more