All Apps and Add-ons

Can someone explain how splunk stream can be used to get email headers

schandrasekar
Loves-to-Learn

The goal is to find the delay between the time sender sents the mail and recipient receive the mail , if the delay is more than 10 mins then alert

Options tried:

Message tracking logs C:\Program Files\Microsoft\Exchange Server\V14\TransportRoles\Logs\MessageTracking in exchange server2010. But the logs didn provide the actual time when the user sent the email, also the original IP of the sender is replaced with LB/Exchange server/relay server/firewall. 

So now I looking for other options. One of them is using Splunk stream. 

Please provide your suggestions.

Labels (3)
0 Karma

thambisetty
Super Champion

In the message tracking logs, you should see field called event which actually contains SEND,DELIVER,RECEIVE 

if you can minus the time of send from time of receive  by message_id then you should get what you want.

————————————
If this helps, give a like below.
0 Karma

schandrasekar
Loves-to-Learn

@thambisetty date_time doesn't look like the time when the message was sent by the user. Also, I am looking for original IP field to be the actual sender IP 

https://docs.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking?view=exchserver-...

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...