Mail To/From The Internet eventtype=summary-internet-mail |timechart count by event_id |rename event_id as "Direction" Mail To/From The Users eventtype=summary-user-mail |timechart count by event_id |rename event_id as "Direction"