SMTP TLS Reporting index=email sourcetype=smtp:tls organization_name=$organization_name$ | spath policies{} output=policy | mvexpand policy | spath input=policy | search policy_domain=$policy_domain$ policy_type=$policy_type$ | rename successful_session_count as successful_sessions | rename failed_session_count as failed_sessions | fillnull value=0 failed_sessions successful_sessions $time_range.earliest$ $time_range.latest$

-7d@h now Organization name * * Policy domain * * Policy type Any tlsa sts no-policy-found * *

| stats sum(successful_sessions) as successful_sessions sum(failed_sessions) as failed_sessions by organization_name | sort -successful_sessions 0 noneprogressbar | stats sum(successful_sessions) as successful_sessions sum(failed_sessions) as failed_sessions by policy_domain, policy_type | sort -successful_sessions 0 noneprogressbar | spath input=policy path=failure_details{} output=detail | mvexpand detail | spath input=detail | where failed_session_count > 0 | rename result_type as failure_type | rename receiving_ip as receiving_mta_ip | fillnull value="none" failure_type sending_mta_ip receiving_mta_ip receiving_mx_hostname | stats sum(failed_session_count) as failed_sessions by organization_name, policy_domain, policy_type, failure_type, sending_mta_ip, receiving_mta_ip, receiving_mx_hostname noneprogressbar