How to search for new email senders in my organization?

New Member

I want to see everyday new email senders in my organization.
I'm getting O365 logs to splunk.
Could you please provide the syntax how i can get new email senders every day.

Labels (1)
0 Karma

New Member

Thank you for response.

I've already tried one search query with lookup option but my lookup had 30k lines bur search taking only for 10k lines. So I'm thinking to have search query without lookup query.

Query : i need to search for last 7 days events and should get output for src_user which are not listed in last 7 days

I hope my query is clear now.

Thank You,

0 Karma

Path Finder

Hi Ram,

Did you end up finding a workable solution for this?
I have the same problem with a lookup, it is matching more then 1000 so it still produces results that
NOT [|inputlookup emailsenders.csv | fields SenderAddress ]
in my base search

0 Karma

Revered Legend
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...