topic Re: checking list of email domains appear in a field in Splunk Search

checking list of email domains appear in a field

ChrisCLewis — Thu, 29 Nov 2018 14:02:55 GMT

I have a field (recipient) which contains all the recipients that an email was sent to. I also have a lookupcsv file with field (watch) which list of domain address to look for e.g. gmail.com

How can I check to see if a domain from the lookup csv appears anywhere within the recipient field - I need it as a filter so I can do work with the remainder of the records data

I have gotten closet using
|join recipient [|inputlookup check.csv |rename watch as recipient|fields recipient]

but it is not returning enough matches.

Many thanks for any pointers

Re: checking list of email domains appear in a field

dkeck — Thu, 29 Nov 2018 14:22:32 GMT

Hi,

if you have a lookup with a field watch and lets say the value of "yes" and "no", you can use the | lookup command

like this : | lookup check.csv recipient OUTPUT watch you could add | fields recipient watch (assuming the field with the domains within the check.csv is called recipient)

then you can search for the value yes within the field watch your search| lookup check.csv recipient OUTPUT watch | fields recipient watch | where watch="yes"

Re: checking list of email domains appear in a field

tmuthuk — Thu, 29 Nov 2018 20:02:01 GMT

Can you try this ?

Extract Domain from the recipient field and join with the Check.csv . Try the below query

Re: checking list of email domains appear in a field

dkeck — Thu, 06 Dec 2018 08:49:22 GMT

please accept answer if it was helpful 🙂