Splunk Search
Highlighted

Ironport: How to get all 'from' emails for specific user

New Member

Hello, I am trying to run a search to get the "EmailFromAddress" of a specific user within ironport.

Can someone please provide the search that would produce that result, please.

For example, I want to know all the from emails that came from user "Joe.Smith@deomain.com"

Any assistance in this regard will be really appreciated!

Thank you in advance for all your help.

Cosmo

0 Karma
Highlighted

Re: Ironport: How to get all 'from' emails for specific user

Influencer

@cosmo360 can you share your logs please. Id the emailfromaddress parsed or you need to extract it?

0 Karma
Highlighted

Re: Ironport: How to get all 'from' emails for specific user

Builder

What is the format of your ironport log events? Can you share a sanitized version of a few events?

0 Karma