To validate your ask: You are currently getting both email addresses that end in lowercase and uppercase 'T', because of the default case-insensitivity of search. You need help figuring out how to only return email addresses that have an uppercase 'T' before the '@mail.cloud'.
Is that what you are really asking?
If so, use the CASE function to interpret your search term exactly as typed:
| search UPN=CASE(*T@mail.cloud)
Can you specify little bit better your request?
you write this:
| search ="UPN=*T@mail.cloud"
but the search comand don't need the "=" symbol
correct example:
| search UPN="*T@mail.cloud"
Ale
@aasabatini Thanks for your reply.
Yes I need regex for
| search UPN=*T@mail.cloud
If I apply this in my query then, I am also getting results for UPN= t*@mail.cloud also getting due to case sensitivity.
Please help me with regex for
| search UPN=*T@mail.cloud
To validate your ask: You are currently getting both email addresses that end in lowercase and uppercase 'T', because of the default case-insensitivity of search. You need help figuring out how to only return email addresses that have an uppercase 'T' before the '@mail.cloud'.
Is that what you are really asking?
If so, use the CASE function to interpret your search term exactly as typed:
| search UPN=CASE(*T@mail.cloud)