topic Re: Display only account that end with @d.com in Reporting

Display only account that end with @d.com

ajromero — Mon, 06 Jul 2020 20:00:32 GMT

This search gives me all the data I need, but I would to display only email accounts that end with an specific name for instance I want to display only accounts that end with @d.com

Here is my query:

Here are my results: The only accounts that I want to display are the ones end with @d.com

and as you can see, the search is showing other accounts like this one @ge.com

can someone tell me how to do this?

thanks

Re: Display only account that end with @d.com

richgalloway — Mon, 06 Jul 2020 20:32:25 GMT

Try replacing

| where recipient<"IID.com"

with

| regex recipient="@d\.com"

Re: Display only account that end with @d.com

ajromero — Mon, 06 Jul 2020 20:55:11 GMT

Hi,

It didn't work. I want to display only recipients that ends with iid.com only

if you see the picture is mixing other accounts from other domains and I want only to display the accounts with the iid.com

thank you

Re: Display only account that end with @d.com

to4kawa — Mon, 06 Jul 2020 20:59:30 GMT

| where match(recipient,"(?i)iid.com")

how about this?

Re: Display only account that end with @d.com

ajromero — Mon, 06 Jul 2020 21:23:39 GMT

awesome , this worked perfect

thanks

but I have another question,

I would like to remove the Email Accounts field that does not have a User Name see below

if that possible

thanks

Re: Display only account that end with @d.com

to4kawa — Mon, 06 Jul 2020 21:29:31 GMT

| where match(recipient,"(?i)iid.com") AND isstr(src_user_nick)

Re: Display only account that end with @d.com

ajromero — Mon, 06 Jul 2020 21:40:51 GMT

it worked

thanks