Splunk Search

I'm trying to perform a subsearch on lookup table and extract two fields using a or statement

dkorlat
Explorer

Hi
I'm trying to perform a subsearch to get a list of users in a lookup table and map the mail field to recipients and sender and perform a
search on recipients or sender. At the moment it's only performing the search if the recipients and senders are both as the recipients and sender .
Is there is a way to change it to search for recipients or senders that match to the fields instead of both fields need to match?
Here is my current search.
index=msexchange sourcetype="MSExchange:2010:MessageTracking" recipients=* OR sender=* [| inputlookup Finance_Users.csv | eval recipients = mail | eval sender = mail | fields recipients, sender] | dedup message_id | eval DLM = coalesce(SEC,DLM) |sort by -_time | convert timeformat="%d/%m/%Y %I:%M:%S %p" ctime(_time) | table _time, sender, recipient, message_subject, DLM | rename sender as Sender, recipient as Recipient, _time as Time, message_subject as Subject

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index=msexchange sourcetype="MSExchange:2010:MessageTracking"  [| inputlookup Finance_Users.csv | eval recipients = mail | eval sender = mail | fields recipients, sender | format "(" "" "OR" "" "OR" ")" ] | dedup message_id | eval DLM = coalesce(SEC,DLM)  |sort by -_time | convert timeformat="%d/%m/%Y %I:%M:%S %p" ctime(_time)  | table _time, sender, recipient, message_subject, DLM | rename sender as Sender, recipient as Recipient, _time as Time, message_subject as Subject

View solution in original post

0 Karma

dkorlat
Explorer

Thanks worked perfectly.

0 Karma

somesoni2
Revered Legend

Try like this

index=msexchange sourcetype="MSExchange:2010:MessageTracking"  [| inputlookup Finance_Users.csv | eval recipients = mail | eval sender = mail | fields recipients, sender | format "(" "" "OR" "" "OR" ")" ] | dedup message_id | eval DLM = coalesce(SEC,DLM)  |sort by -_time | convert timeformat="%d/%m/%Y %I:%M:%S %p" ctime(_time)  | table _time, sender, recipient, message_subject, DLM | rename sender as Sender, recipient as Recipient, _time as Time, message_subject as Subject
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...