topic Re: Getting full mail transaction with Exim in Getting Data In

Getting full mail transaction with Exim

leonrtx — Mon, 28 Sep 2020 13:58:53 GMT

I want to display all mail to and from a client, with the subject, relayed host and status in one dashboard. The dashboard has a form search where you enter a mail address. Using the transaction command works, but it takes to long to be usable. Here's my transaction search:

sourcetype="exim-mainlog" | transaction host,Exim_Message_ID | table exim_message_id,from_address,to_address,T,H

I tried using subsearches, but it doesn't work. Looks like subsearches might be broken in Splunk 5

sourcetype="exim-mainlog" [sourcetype="exim-mainlog" from_address="address" OR to_address="address" | table Exim_Message_ID]

Any other ideas on how I can do this?

Re: Getting full mail transaction with Exim

Ayn — Mon, 27 May 2013 08:25:38 GMT

Subsearches broken? That's kind of a bold statement 🙂 Subsearches are used extensively not just by the users but also in the core product - if it was broken, trust me, you would have found out long ago. Your syntax in your example is off though. You need to explicitly specify "search" at the beginning of the subsearch.

Re: Getting full mail transaction with Exim

leonrtx — Mon, 28 Sep 2020 13:58:58 GMT

ah, wrong in the post, but was correct in Splunk. sourcetype="exim-mainlog" [search sourcetype="exim-mainlog" from_address="address" OR to_address="address" | table Exim_Message_ID]

When I run the subsearch I get no results but when I inspect the search, it's build the search correctly. So when I inspect it build the search:
sourcetype="exim-mainlog ((Exim_Message_ID=####) OR (Exim_Message_ID =####))
If I copy and paste the search from the inspect page into the search box it return the correct results. So why doesn't I see any results in the sub search?

Re: Getting full mail transaction with Exim

leonrtx — Wed, 29 May 2013 13:43:34 GMT

OK, so sub searches has been fixed in version 5.0.3. SPL-62457 and is working now.

Re: Getting full mail transaction with Exim

jgreenhalgh — Mon, 28 Sep 2020 14:25:15 GMT

Hi, where is Exim_Message_ID coming from? I've just started pointing Splunk at some exim logs and it's not one of the fields I'm seeing.

Re: Getting full mail transaction with Exim

lostpassword — Tue, 12 Nov 2013 05:34:31 GMT

To add Exim messsage ID field, try to add attribute by Regular expression.
In my case, message ID can be extracted by this expression:
"(?\w\w\w\w\w\w-\w\w\w\w\w\w-\w\w)"

Re: Getting full mail transaction with Exim

ipchristian — Fri, 15 Nov 2013 16:35:50 GMT

I'm new to splunk - is there a link to explain how to add the regular expression into splunk, so it can show the message ID?

Re: Getting full mail transaction with Exim

lostpassword — Fri, 15 Nov 2013 17:59:33 GMT

Well, I'm new too.)
I don't know whether it is right approach... But you can try this: "Data models" ->

Re: Getting full mail transaction with Exim

lostpassword — Fri, 15 Nov 2013 17:59:44 GMT

I'm writing all this by memory, so some parts may be incorrect. By the way, I haven't yet found a way to make Splunk understand Exim logs. I'm quite interested whether it is possible. If you will be able to achieve some progress, please spend a minute and share it here - or mail me at igonin.a.arsreu.ru.