topic How can I show o365 email logs in a table? in Alerting

How can I show o365 email logs in a table?

sulaimancds — Mon, 13 Mar 2023 13:44:50 GMT

{"Organization": "groupxyz.onmicrosoft.com", "MessageId": "<12345678>", "Received": "2023-03-13T01:56:22.9207071", "SenderAddress": "bca@bca.com", "RecipientAddress": "dlf@g.com", "Subject": "12312312332231'", "Status": "Delivered", "ToIP": "111.1.11.1", "FromIP": "12.23.4.2.23232", "Size": 2022121 "MessageTraceId": "4f74644747749djhrhfbf", "Index": 0}

hi this is my raw data; how can i show it in a table in a nice format?

index=mail , and please help

RecipientDomain

sender

recipient

subject

Earliest

Latest

Re: o365 email logs table query

bowesmana — Mon, 13 Mar 2023 03:50:38 GMT

Where do you want earliest and latest to come from?

Add this to your search

| spath | rex field=RecipientAddress "(?<recipient>[^@]*)@(?<RecipientDomain>.*)" | rex field=SenderAddress "(?<sender>[^@]*)" | table RecipientDomain sender recipient Subject Earliest Latest

Re: o365 email logs table query

sulaimancds — Mon, 13 Mar 2023 04:00:15 GMT

sorry changed the table to Received.

this is the raw log

Received: 2023-03-13T02:56:22.5381743

Re: o365 email logs table query

sulaimancds — Mon, 13 Mar 2023 04:08:48 GMT

i need the full recipient email and sender email to be shown in the table

only recipient domain will show the domain like google.com, yahoo.com

Re: o365 email logs table query

bowesmana — Mon, 13 Mar 2023 05:26:51 GMT

Then just change the table command to this and remove the second rex statement as it's not needed.

| table RecipientDomain SenderAddress RecipientAddress Subject Received

Use rename to rename the fields as you want them

Re: o365 email logs table query

sulaimancds — Thu, 16 Mar 2023 06:30:46 GMT

hi i need to match those sender domain = gmail.com

can you help me with the query ?

index=mail
| dedup MessageTraceId
| rex field=SenderAddress "(?<Sender>[^@]*)@(?<SenderDomain>.*)"
| where SenderDomain == gmail.com
| table SenderDomain SenderAddress RecipientAddress Subject Earliest Latest

the 4th line does not work . please help

Re: o365 email logs table query

bowesmana — Fri, 17 Mar 2023 01:02:51 GMT

Quote the string you are trying to match in the where clause

| where SenderDomain = "gmail.com"