Reporting

email from specific domain

rashid47010
Communicator

I want to exlude specific domains from both sender and receipient.
for example I have abc.com domain and have one lookup file with legitiamate domain names.
Now I want to see a emails which is not include either as sender or receipient in that lookup file.

OR in simple words how can I compare lookup values againt two fields(sender and receipient)

Tags (1)
0 Karma

vnravikumar
Champion

Hi @rashid47010

Try this

| makeresults 
| eval sender="test@test.com" 
| eval receiver="test1@test.com" 
| rex field=sender "@(?P<senderdomain>.*)" 
| lookup domainlookup domain as senderdomain OUTPUT domain as senderflag 
| rex field=receiver "@(?P<receiverdomain>.*)" 
| lookup domainlookup domain as receiverdomain OUTPUT domain as receiverflag 
| where isnull(senderflag) AND isnull(receiverflag)

lookup: domainlookup

domain
abc.com
test.com

0 Karma

vnravikumar
Champion

@rashid47010, have you tried?

0 Karma

vnravikumar
Champion

Its solved?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...