Splunk Search

Filter sender email which not contains specific subdomain and domain

silverem78
Engager

Dear all,

I try to filter sender email which not contains specific 3 subdomains and domain.

For example:

sender:

user1@aaa.domain.com

user2@bbb.domain.com

user355@ccc.domain.com

userxxx@gmail.com

useryyy@top.domain2.com

i want just display with stats sender userxxx@gmail.comand user useryyy@top.domain2.com

I try to add

index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 and sender !="[\w][\w\-\.]+@(?domain.com)"

or using this:

| rex field=sender "[\w][\w\-\.]+@(?<domain>\w[\w\-\.]+[a-zA-Z]{2,5})"
| stats sum(count) as count by domain_detected
| eval domain_detected=mvfilter(domain_detected!="*.domain.com")

without success

 

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 AND NOT match(sender, "\w[\w\-\.]+@\w+\.domain\.com$")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 AND NOT match(sender, "\w[\w\-\.]+@\w+\.domain\.com$")
0 Karma

silverem78
Engager

Thank you . Works like a charm

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...