Dear all,
I try to filter sender email which not contains specific 3 subdomains and domain.
For example:
sender:
i want just display with stats sender userxxx@gmail.comand user useryyy@top.domain2.com
I try to add
index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 and sender !="[\w][\w\-\.]+@(?domain.com)"
or using this:
| rex field=sender "[\w][\w\-\.]+@(?<domain>\w[\w\-\.]+[a-zA-Z]{2,5})"
| stats sum(count) as count by domain_detected
| eval domain_detected=mvfilter(domain_detected!="*.domain.com")
without success
index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 AND NOT match(sender, "\w[\w\-\.]+@\w+\.domain\.com$")
index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 AND NOT match(sender, "\w[\w\-\.]+@\w+\.domain\.com$")
Thank you . Works like a charm