topic Re: query filter csv emails in Alerting

Search filter csv emails based off of another csv?

sulaimancds — Thu, 02 Mar 2023 15:27:50 GMT

index=mail | lookup email_domain_whitelist domain AS RecipientDomain output domain as domain_match | where isnull(domain_match) | table subject sender values(recipient) values(RecipientDomain) Count values(size)``` | stats values(recipient) values(subject) count by RecipientDomain sender | sort -count

i have this search running daily. based on the results from the search, i want to compare the sender field result with another csv file call 123.csv in lookup , there is a field call Email Address in this csv, give me the results if there is a match.

Please help.

Thank you.

Re: query filter csv emails

ITWhisperer — Thu, 02 Mar 2023 09:23:16 GMT

Am I missing something or isn't the answer in the question?

| lookup 123.csv "Email Address" as sender

Re: query filter csv emails

sulaimancds — Fri, 03 Mar 2023 03:08:27 GMT

hi where do i add this line , because it is showing me all the results , not those which match the 123.csv?

Re: query filter csv emails

Tom_Lundie — Fri, 03 Mar 2023 03:21:48 GMT

Add this to the bottom of your search:

| lookup 123.csv "Email Address" as sender | where isnotnull('Email Address')

To filter the results for only the Email Addresses in 123.csv