How to search for new email senders in my organization?

[Ram7789]

I want to see everyday new email senders in my organization.
I'm getting O365 logs to splunk.
Could you please provide the syntax how i can get new email senders every day.

[Ram7789]

Thank you for response.

I've already tried one search query with lookup option but my lookup had 30k lines bur search taking only for 10k lines. So I'm thinking to have search query without lookup query.

Query : i need to search for last 7 days events and should get output for src_user which are not listed in last 7 days

I hope my query is clear now.

Thank You,
Ram

[geraldcontreras]

Hi Ram,

Did you end up finding a workable solution for this?
I have the same problem with a lookup, it is matching more then 1000 so it still produces results that
using
NOT [|inputlookup emailsenders.csv | fields SenderAddress ]
in my base search

[somesoni2]

Here is the similar use-case.
https://answers.splunk.com/answers/422889/how-to-search-for-newly-added-servers-by-comparing.html