How to rex the root domain and parse the .TLD from email sender logs?

[packet_hunter]

Scenario: I am trying to list all incoming sender domains and tlds. For example, sender@blah.domain.tld, looking for just "domain" and "tld". For some reason I am not finding the right syntax. I am also not interested in senders from my domain.

enter code
index=mail sourcetype=xemail sender != *@mydomain* | search sender =* | rex field = sender ".*@(?< domain >.*)" | stats list(domain)
here

In addition to the needed rex syntax, please let me know if there is a more efficient way to achieve this.

Thank you

[javiergn]

What about this (not tested)

| rex field=sender "@(?<domain>[^\.]+).*?(?<tld>[^\.]+)$"

[packet_hunter]

not working

[javiergn]

Just forced the wildcard to be non-greedy. Try now:

| rex field=sender "@(?<domain>[^\.]+).*?(?<tld>[^\.]+)$"

[packet_hunter]

This works now too. Thanks

[somesoni2 · Accepted solution]

Try something like this

Updated
removed a bracket

index=mail sourcetype=xemail sender != @mydomain | search sender= | rex field=sender "[@\.](?<domain>\w+\.\w+)$" | stats list(domain)

To get tld as separate field

  index=mail sourcetype=xemail sender != @mydomain | search sender= | rex field=sender "[@\.](?<domain>\w+)\.(?<tld>\w+)$" | stats list(domain)

[packet_hunter]

| search sender= * | rex field=sender "[@\.]((?<domain>\w+)\.\w+)$" | stats list(domain)

this works for just the root domains, but do you have an example with .tlds in a separate column as well?

Thank you!