Hi,
I've been trying to solve this one with various hints given here already (subsearch, use of eval, etc), but haven't found an approach that works...
I have a list of email addresses, as well as the first name and last name of the account owner.
I'm trying to build up a list of events/entries where neither the first nor the last name appears anywhere obvious in the email address itself.
By using eval, it was easy enough to split the email account name from the domain, but, what's the best way to find the following:
First Last Email ---------------------------------------- Tom Smith tsmith@foo.com Jane Doe yellowpony@blerp.edu Bob Jones bobjo@morp.com
What I'd like to do is have only Jane Doe show up in a query, as only her address contains neither her first name or last name.
Thanks for any suggestions!
Use where
and match the first and last name with the email address.
... | where !(match(lower(Email),lower(First)) OR match(lower(Email),lower(Last)))
Use where
and match the first and last name with the email address.
... | where !(match(lower(Email),lower(First)) OR match(lower(Email),lower(Last)))
D'OH, I had tried match, but didn't think about the lower() first. Thanks!