Implementing Splunk 7, Third Edition - Third Edition

Subsearch

Let's start with these events:

2015-02-10 12:59:59 msgid=704783 from=[e-mail] to=[e-mail] 
2015-02-10 12:59:59 msgid=171755 from=[e-mail] to=[e-mail] 
2015-02-10 12:59:59 msgid=668955 from=[e-mail] to=[e-mail] 
2015-02-10 12:59:59 msgid=001404 from=[e-mail] to=[e-mail] 
2015-02-10 12:59:59 msgid=284794 from=[e-mail] to=[e-mail] 
2015-02-10 12:59:59 msgid=362127 from=[e-mail] to=[e-mail] 
2015-02-10 12:59:59 msgid=571419 from=[e-mail] to=ronnie@g&r.com 

From these events, let's find out to whom mary has sent messages. In these events, we see that the from and to values are in different entries. We can use stats to pull ...