You'll need to put the 'eval' statement in those stats commands suggested by @ITWhisperer | stats count(eval(match('Customers Email',".*\.gov"))) as "gov"
count(eval(match('Customers Email',".*\.org"))) as "org"
count(eval(match('Customers Email',".*\.com"))) as "com"
count(eval(match('Customers Email',".*\.edu"))) as "edu"
count(eval(match('Customers Email',".*\.us"))) as "us"
count(eval(match('Customers Email',".*\.net"))) as "net" but note that the match statement will match anywhere in the string, so if your email is me@this.governor.com it will match .gov as well as .com so you should add a $ sign at the end of the match string to ensure the end of string. Alternatively, if you are just looking to count TLDs in email addresses, you could do | rex field="Customers Email" ".*\.(?<tld>.*)"
| stats count by tld
| transpose 0 header_field=tld
| fields - column which would catch all tlds, not just the ones in the eval - just in case you had some there you didn't expect - if you don't want them, you can always filter them out.
... View more