Hello, I am trying to perform a search against a lookup table that contains 2 columns (RDOMAIN and SDOMAIN). I would like the search to pull back all matching SDOMAINS and anything that does NOT match RDOMAIN. sourcetype=8*| rex field=rcpt "\S+@(?;RDOMAIN;\S+)" | rex field=from "\S+@(?;SDOMAIN;\S+)" | search [inputlookup "MMDomains.csv" | search SDOMAIN=* | search NOT RDOMAIN ] ... View more

Hello, I am trying to create a search where the same IP is used more than 50 times by the same email address. So far this is all that I have: index=* sourcetype=* | stats count by ip | where count > 50 I've tried using various stats commands to add in the usernames, but nothing seems to be working. Any help would be appreciated. ... View more