Reporting

Display only account that end with @d.com

ajromero
Path Finder

This search gives me all the data I need, but I would to display only email accounts that end with an specific name for instance I want to display only accounts that end with @d.com 

Here is my query:

ajromero_0-1594064957661.png

Here are my results: The only accounts that I want to display are the ones end with @d.com

ajromero_2-1594065451636.png

and as you can see, the search is showing other accounts like this one @ge.com

can someone tell me how to do this?

thanks

Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try replacing

| where recipient<"IID.com"

with

| regex recipient="@d\.com"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

ajromero
Path Finder

Hi,

It didn't work. I want to display only recipients that ends with iid.com only 

if you see the picture is mixing other accounts from other domains and I want only to display the accounts with the iid.com

ajromero_0-1594068864167.png

thank you

0 Karma

to4kawa
Ultra Champion
| where match(recipient,"(?i)iid.com")

how about this?

ajromero
Path Finder

awesome , this worked perfect

thanks

but  I have another question,

I would like to remove the Email Accounts field that does not have a User Name see below

ajromero_0-1594070551961.png

if that possible

thanks

0 Karma

to4kawa
Ultra Champion

| where match(recipient,"(?i)iid.com") AND isstr(src_user_nick)

ajromero
Path Finder

it worked 

thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...