Splunk Search

Filter sender email which not contains specific subdomain and domain

silverem78
Engager

Dear all,

I try to filter sender email which not contains specific 3 subdomains and domain.

For example:

sender:

user1@aaa.domain.com

user2@bbb.domain.com

user355@ccc.domain.com

userxxx@gmail.com

useryyy@top.domain2.com

i want just display with stats sender userxxx@gmail.comand user useryyy@top.domain2.com

I try to add

index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 and sender !="[\w][\w\-\.]+@(?domain.com)"

or using this:

| rex field=sender "[\w][\w\-\.]+@(?<domain>\w[\w\-\.]+[a-zA-Z]{2,5})"
| stats sum(count) as count by domain_detected
| eval domain_detected=mvfilter(domain_detected!="*.domain.com")

without success

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 AND NOT match(sender, "\w[\w\-\.]+@\w+\.domain\.com$")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 AND NOT match(sender, "\w[\w\-\.]+@\w+\.domain\.com$")
0 Karma

silverem78
Engager

Thank you . Works like a charm

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...