Splunk Search

I'm trying to perform a subsearch on lookup table and extract two fields using a or statement

dkorlat
Explorer

Hi
I'm trying to perform a subsearch to get a list of users in a lookup table and map the mail field to recipients and sender and perform a
search on recipients or sender. At the moment it's only performing the search if the recipients and senders are both as the recipients and sender .
Is there is a way to change it to search for recipients or senders that match to the fields instead of both fields need to match?
Here is my current search.
index=msexchange sourcetype="MSExchange:2010:MessageTracking" recipients=* OR sender=* [| inputlookup Finance_Users.csv | eval recipients = mail | eval sender = mail | fields recipients, sender] | dedup message_id | eval DLM = coalesce(SEC,DLM) |sort by -_time | convert timeformat="%d/%m/%Y %I:%M:%S %p" ctime(_time) | table _time, sender, recipient, message_subject, DLM | rename sender as Sender, recipient as Recipient, _time as Time, message_subject as Subject

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=msexchange sourcetype="MSExchange:2010:MessageTracking"  [| inputlookup Finance_Users.csv | eval recipients = mail | eval sender = mail | fields recipients, sender | format "(" "" "OR" "" "OR" ")" ] | dedup message_id | eval DLM = coalesce(SEC,DLM)  |sort by -_time | convert timeformat="%d/%m/%Y %I:%M:%S %p" ctime(_time)  | table _time, sender, recipient, message_subject, DLM | rename sender as Sender, recipient as Recipient, _time as Time, message_subject as Subject

View solution in original post

0 Karma

dkorlat
Explorer

Thanks worked perfectly.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=msexchange sourcetype="MSExchange:2010:MessageTracking"  [| inputlookup Finance_Users.csv | eval recipients = mail | eval sender = mail | fields recipients, sender | format "(" "" "OR" "" "OR" ")" ] | dedup message_id | eval DLM = coalesce(SEC,DLM)  |sort by -_time | convert timeformat="%d/%m/%Y %I:%M:%S %p" ctime(_time)  | table _time, sender, recipient, message_subject, DLM | rename sender as Sender, recipient as Recipient, _time as Time, message_subject as Subject
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...