Ironport: How to get all 'from' emails for specific user

[cosmo360]

Hello, I am trying to run a search to get the "Email_From_Address" of a specific user within ironport.

Can someone please provide the search that would produce that result, please.

For example, I want to know all the from emails that came from user "Joe.Smith@deomain.com"

Any assistance in this regard will be really appreciated!

Thank you in advance for all your help.

Cosmo

[jnudell_2]

What is the format of your ironport log events? Can you share a sanitized version of a few events?

[Vijeta]

@cosmo360 can you share your logs please. Id the email_from_address parsed or you need to extract it?