KQL EmailEvents by country - improved! EmailEvents | where geo_info_from_ip_address(SenderIPv4) != "" | extend GeoIPInfo = geo_info_from_ip_address(SenderIPv4) | extend country = tostring(parse_json(GeoIPInfo).country) | project country | summarize count()by country

6 likes 0 replies