Email Countby Country
Query
//Count of emails by country
EmailEvents
| extend GeoInformation = parse_json(geo_info_from_ip_address(SenderIPv4))
| extend NwMsgId_Recipient = strcat(NetworkMessageId, "_", RecipientEmailAddress)
| summarize dcount(NwMsgId_Recipient) by tostring(GeoInformation.country)Explanation
This query counts the number of emails sent from each country. It first extracts the country information from the sender's IP address, then combines the network message ID and recipient email address. Finally, it counts the unique combinations of network message ID and recipient email address for each country.
Details
Rod Trent
Released: June 10, 2024
Tables
EmailEvents
Keywords
EmailEventsGeoInformationNwMsgId_RecipientNetworkMessageIdRecipientEmailAddress
Operators
extendparse_jsonstrcatsummarizedcounttostring