index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats values(sender) as sender by msg_id | eventstats dc(sender) as multi_sender by msg_id | where multi_sender > 50
We are have SMG in our company and it has been integrated successfully into Splunk as well. I am trying now to find out who are the top 50 email senders. Is the above search correct? If not, kindly let me know what has to be changed.
Regards
Pradeep
Hi there @seetharamanPr
Try like this:
index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats count by sender | sort - count | head 50
Hope it helps
Hi there @seetharamanPr
Try like this:
index=mail sourcetype="symantec:mail:syslog" sender "ML-DELIVERY" | stats count by sender | sort - count | head 50
Hope it helps
Thank you alemarzu
the command works and I am able to see who is sending the most mails.
Regards
Pradeep
Nice, I'm glad it helped !