Try something like this:
index=_internal sourcetype=scheduler alert_actions=*email* | timechart span=1d sum(fired) as "Emails sent per day"
Try something like this:
index=_internal sourcetype=scheduler alert_actions=*email* | timechart span=1d sum(fired) as "Emails sent per day"
If you don't have per-result alerts then yeah, counting those events will do.
For some reason fired didn't produce the correct results, but the count of events over time worked for us. Thank you for your help.