Has anyone successfully integrated a Microsoft IIS SMTP server into Splunk? The logs the service creates are steps in a transaction rather than individual entries for actual emails sent. I wanted to normalize the log source to feed into the Email data model, but the logs are such a mess I am considering just deploying a different email relay that has better logging.
I'd be particularly interested to know how to create single events that represent a sent email from the 10 or so individual rows that represent an email transaction. I realize you can use the transaction command, but I need an actual row to feed into a data model that can be accelerated.
