Scenario: I am trying to list all incoming sender domains and tlds. For example, sender@blah.domain.tld, looking for just "domain" and "tld". For some reason I am not finding the right syntax. I am also not interested in senders from my domain.
enter code
index=mail sourcetype=xemail sender != *@mydomain* | search sender =* | rex field = sender ".*@(?< domain >.*)" | stats list(domain)
here
In addition to the needed rex syntax, please let me know if there is a more efficient way to achieve this.
Thank you
Try something like this
Updated
removed a bracket
index=mail sourcetype=xemail sender != @mydomain | search sender= | rex field=sender "[@\.](?<domain>\w+\.\w+)$" | stats list(domain)
To get tld as separate field
index=mail sourcetype=xemail sender != @mydomain | search sender= | rex field=sender "[@\.](?<domain>\w+)\.(?<tld>\w+)$" | stats list(domain)
What about this (not tested)
| rex field=sender "@(?<domain>[^\.]+).*?(?<tld>[^\.]+)$"
not working
Just forced the wildcard to be non-greedy. Try now:
| rex field=sender "@(?<domain>[^\.]+).*?(?<tld>[^\.]+)$"
This works now too. Thanks
Try something like this
Updated
removed a bracket
index=mail sourcetype=xemail sender != @mydomain | search sender= | rex field=sender "[@\.](?<domain>\w+\.\w+)$" | stats list(domain)
To get tld as separate field
index=mail sourcetype=xemail sender != @mydomain | search sender= | rex field=sender "[@\.](?<domain>\w+)\.(?<tld>\w+)$" | stats list(domain)
| search sender= * | rex field=sender "[@\.]((?<domain>\w+)\.\w+)$" | stats list(domain)
this works for just the root domains, but do you have an example with .tlds in a separate column as well?
Thank you!