Reporting

How to remove a particular domain (of email id) from action type?

preethi123
New Member

I have email entries logged in Splunk. I need to filter out a particular domain of the emails when I list them separately. Like for example, I don't want to see the emails from abc domain (user@abc.com should not be listed in the results). How to go about that?

0 Karma
1 Solution

somesoni2
Revered Legend

Is the email extracted as field?? if yes than you can try something like this

index=blah sourcetype=blah youremailfieldname!="*@abc.com" | rest of the search

If its not extracted as field, try something like this

index=blah sourcetype=blah NOT "*@abc.com*" | rest of the search

View solution in original post

somesoni2
Revered Legend

Is the email extracted as field?? if yes than you can try something like this

index=blah sourcetype=blah youremailfieldname!="*@abc.com" | rest of the search

If its not extracted as field, try something like this

index=blah sourcetype=blah NOT "*@abc.com*" | rest of the search
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...