How can I show o365 email logs in a table?

[sulaimancds]

{"Organization": "groupxyz.onmicrosoft.com", "MessageId": "<12345678>", "Received": "2023-03-13T01:56:22.9207071", "SenderAddress": "bca@bca.com", "RecipientAddress": "dlf@g.com", "Subject": "12312312332231'", "Status": "Delivered", "ToIP": "111.1.11.1", "FromIP": "12.23.4.2.23232", "Size": 2022121 "MessageTraceId": "4f74644747749djhrhfbf", "Index": 0}

hi this is my raw data; how can i show it in a table in a nice format?

index=mail , and please help

RecipientDomain

sender

recipient

subject

Earliest

Latest

[bowesmana]

Where do you want earliest and latest to come from?

Add this to your search

| spath
| rex field=RecipientAddress "(?<recipient>[^@]*)@(?<RecipientDomain>.*)"
| rex field=SenderAddress "(?<sender>[^@]*)"
| table RecipientDomain sender recipient Subject Earliest Latest

[sulaimancds]

sorry changed the table to Received. 

this is the raw log 

Received: 2023-03-13T02:56:22.5381743

[sulaimancds]

i need the full recipient email and sender email to be shown  in the table

only recipient domain will show the domain like google.com, yahoo.com

[bowesmana]

Then just change the table command to this and remove the second rex statement as it's not needed.

| table RecipientDomain SenderAddress RecipientAddress Subject Received

Use rename to rename the fields as you want them

[sulaimancds]

hi i need to match those sender domain = gmail.com

can you help me with the query ?

index=mail 
| dedup MessageTraceId
| rex field=SenderAddress "(?<Sender>[^@]*)@(?<SenderDomain>.*)"
| where SenderDomain == gmail.com
| table SenderDomain SenderAddress RecipientAddress Subject Earliest Latest

the 4th line does not work . please help

[bowesmana]

Quote the string you are trying to match in the where clause

| where SenderDomain = "gmail.com"