Email Countby Country
Query
//Count of emails by country
EmailEvents
| extend GeoInformation = parse_json(geo_info_from_ip_address(SenderIPv4))
| extend NwMsgId_Recipient = strcat(NetworkMessageId, "_", RecipientEmailAddress)
| summarize dcount(NwMsgId_Recipient) by tostring(GeoInformation.country)Explanation
This query counts the number of emails sent from each country. It first extracts the country information from the sender's IP address, then combines the network message ID and recipient email address. Finally, it counts the unique combinations of network message ID and recipient email address for each country.