Unable to create the alert in ES App

[deepak007]

I tried creating an ES App alert to detect if anyone is sending emails to the mentioned blacklisted domains, but its showing me an error

| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where 'recept'=(@gproxy10-pub.mail.unifiedlayer.com or @Anonymous.com) or *@moxydrink.com or @mail.hansonprice.co.nz or *@officelives365.com or jane.somerville@bhpbilliton.com or jane.macgregor@bhpbilliton.com or *@sant0s.com)

Error I am getting
Error in 'where' command: The expression is malformed. An unexpected character is reached at '@gproxy10-pub.mail.unifiedlayer.com or @Anonymous.com) or *@moxydrink.com or @mail.hansonprice.co.nz or *@officelives365.com or jane.somerville@bhpbilliton.com or jane.macgregor@bhpbilliton.com or *@sant0s.com)'.

[p_gurav]

Hi,

Try somthing like this:

| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where (like(recept, "%@gproxy10-pub.mail.unifiedlayer.com" OR like(recept, "%@gmail.com")) OR like(recept, "%@moxydrink.com%") OR like(recept, "%@mail.hansonprice.co.nz") OR like(recept,"%@officelives365.com") OR like(recept, "%jane.somerville@bhpbilliton.com") OR like(recept, "%jane.macgregor@bhpbilliton.com") OR like(recept, "%@sant0s.com")

[deepak007]

Error in 'where' command: The expression is malformed. Expected ).

[p_gurav]

| datamodel "Email" "All_Email" search | stats values(All_Email.recipient) as "recept" | where (like(recept, "%@gproxy10-pub.mail.unifiedlayer.com") OR like(recept, "%@gmail.com")) OR like(recept, "%@moxydrink.com%") OR like(recept, "%@mail.hansonprice.co.nz") OR like(recept,"%@officelives365.com") OR like(recept, "%jane.somerville@bhpbilliton.com") OR like(recept, "%jane.macgregor@bhpbilliton.com") OR like(recept, "%@sant0s.com")

[deepak007]

query did work, but not giving the correct data, it is giving all the sources, however I only need the mentioned ones

[p_gurav]

Can you share some sample recipient data ?