2 3 ITSI Content Pack for Microsoft Exchange normalizes domains to identify duplicate users. You can perform per-user associations if needed. Learn more. Use this page to specify a default DNS domain for users without a domain (unqualified users), such as "john" instead of "john@domain.com". You can also create mappings between DNS and NetBIOS domains.
domain domain | inputlookup domain_alias |eval dummy=$dummy$|fields - dummy|dedup domain -24h@h now
Domains-hide dummy dummy2 | makeresults |eval _key=trim("$alias$"), domain=trim("$domain$")|where _key!="" AND domain!="" | outputlookup domain_alias append=true| fields - _time |eval keydisplay=_key | table domain,keydisplay $earliest$ $latest$
Default domain-hide dummy | makeresults |eval _key="unqualifiedDomain-Reserved", domain="$defaultDomain$" | eval dummy=$dummy2$ |fields - _time,dummy |outputlookup domain_alias append=true -24h@h now
Domain Alias Mappings |inputlookup domain_alias |eval keydisplay=_key |eval domain_alias=case(keydisplay=="unqualifiedDomain-Reserved","Unknown Alias",keydisplay!="unqualifiedDomain-Reserved",keydisplay)| eval delete="delete"|eval dummy=$dummy$|fields - dummy | table domain_alias, domain , delete, _key -24h@h now $row._key$

Click here to run saved searches to fill lookups

Click me
Delete Domain | inputlookup domain_alias | where _key!="$delete_key$"| outputlookup domain_alias domain_alias -24h@h now