https://community.splunk.com/t5/Splunk-Search/Incorrect-Imail-Events/m-p/43162#M10144 <P>I am trying to have my Imail Logs indexed correctly. Right now there is no order to the events. They should be separated by Connection ID</P> <P>Examples:</P> <P>SMTP-(b200000069dbca52)</P> <P>SMTP-(2edb0000685cc69c)</P> <P>SMTPD(2edb0000685cc69c)</P> <P>SMTPD(0000000000000000)</P> <P>I have tried the Field Extraction Generator but it hasnot been able to correctly identfify the connection ID.</P> Thu, 14 Jul 2011 20:19:36 GMT jknowles 2011-07-14T20:19:36Z https://community.splunk.com/t5/Splunk-Search/Incorrect-Imail-Events/m-p/43162#M10144 <P>I am trying to have my Imail Logs indexed correctly. Right now there is no order to the events. They should be separated by Connection ID</P> <P>Examples:</P> <P>SMTP-(b200000069dbca52)</P> <P>SMTP-(2edb0000685cc69c)</P> <P>SMTPD(2edb0000685cc69c)</P> <P>SMTPD(0000000000000000)</P> <P>I have tried the Field Extraction Generator but it hasnot been able to correctly identfify the connection ID.</P> Thu, 14 Jul 2011 20:19:36 GMT https://community.splunk.com/t5/Splunk-Search/Incorrect-Imail-Events/m-p/43162#M10144 jknowles 2011-07-14T20:19:36Z https://community.splunk.com/t5/Splunk-Search/Incorrect-Imail-Events/m-p/43163#M10145 <P>try piping your query to | rex field=_raw "SMTP[-D]((?<CONNECTIONID>[a-f0-9]*))"<BR /> That should extract the connection id to its own field. If that works i would suggest using that regex as a field extraction in props.conf.</CONNECTIONID></P> <P>Hope that helps!</P> Thu, 14 Jul 2011 22:42:19 GMT https://community.splunk.com/t5/Splunk-Search/Incorrect-Imail-Events/m-p/43163#M10145 jedinerd 2011-07-14T22:42:19Z