I have a query to calculate the average recipient count for Exchange:
index=msexchange
sourcetype=MSExchange:2010:MessageTracking
sender="sunj@advisory.com"
((source_id=STOREDRIVER event_id=RECEIVE) OR (source_id=ROUTING event_id=EXPAND))
| fillnull value=NULL message_subject
| eval s_msg_sub=lower(message_subject)
| search s_msg_sub!="out of office*" s_msg_sub!="automatic reply*"
| dedup internal_message_id
| stats max(recipient_count) as max_recipient_count BY internal_message_id
| stats count(internal_message_id) as emails_sent, sum(max_recipient_count) as email_recipient_count
| table emails_sent, email_recipient_count
I have no problem run this query directly via browser. However when running it over REST API call. One of the calculate field is missing from the result:
emails_sent email_recipient_count 686
This seems coincide with upgrading from 6.3.0 to 6.4.2.
Any thoughts on how to resolve this?
Thanks,
Jeffery
↧