Filter sender email which not contains specific subdomain and domain

[silverem78]

Dear all,

I try to filter sender email which not contains specific 3 subdomains and domain.

For example:

sender:

user1@aaa.domain.com

user2@bbb.domain.com

user355@ccc.domain.com

userxxx@gmail.com

useryyy@top.domain2.com

i want just display with stats sender userxxx@gmail.comand user useryyy@top.domain2.com

I try to add

index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 and sender !="[\w][\w\-\.]+@(?domain.com)"

or using this:

| rex field=sender "[\w][\w\-\.]+@(?<domain>\w[\w\-\.]+[a-zA-Z]{2,5})"
| stats sum(count) as count by domain_detected
| eval domain_detected=mvfilter(domain_detected!="*.domain.com")

without success

[ITWhisperer · Accepted solution]

index = * sourcetype="cisco:esa:textmail" OR sourcetype=MSExchange* | eventstats values(src) AS cs_ip BY icid
[...} where mvcount(recipient) > 5 AND NOT match(sender, "\w[\w\-\.]+@\w+\.domain\.com$")

[silverem78]

Thank you . Works like a charm