SMTP TLS Reporting index=email sourcetype=smtp:tls organization_name=$organization_name$ policies{}.policy_domain=$policy_domain$ policies{}.policy_type=$policy_type$ | rename policies{}.policy_domain as policy_domain | rename policies{}.policy_type as policy_type | rename policies{}.failed_session_count as failed_sessions | rename policies{}.successful_session_count as successful_sessions | rename policies{}.failure_details{}.receiving_mx_hostname as receiving_mx_hostname | rename policies{}.failure_details{}.result_type as failure_type | rename policies{}.failure_details{}.sending_mta_ip as sending_mta_ip | rename policies{}.failure_details{}.receiving_ip as receiving_mta_ip | fillnull value=0 failed_sessions successful_sessions | table * | table * $time_range.earliest$ $time_range.latest$

-7d@h now Organization name * * Policy domain * * Policy type Any tlsa sts no-policy-found * *

| stats sum(successful_sessions) as successful_sessions sum(failed_sessions) as failed_sessions by organization_name | sort -successful_sessions 0 noneprogressbar | stats sum(successful_sessions) as successful_sessions sum(failed_sessions) as failed_sessions by policy_domain, policy_type | sort -successful_sessions 0 noneprogressbar where failed_sessions > 0 | stats sum(failed_sessions) as failed_sessions by organization_name, policy_domain, policy_type, failure_type, sending_mta_ip, receiving_mta_ip, receiving_mx_hostname noneprogressbar