Getting Data In

Cisco ESA Textmail Summary Index

david_monaghan
Engager

Hi All,

I am trying to create summary index for Cisco ESA Textmail logs. I will then rebuild the Email data model using the summary index.

The scheduled search is running correctly but when I try to search the summary index I get no events returned.

How does one check that events are going into the summary index correctly?

Steps Taken

  1. Created a new index called email_summary
  2. I have created a scheduled search to run every 15 minutes
  3. In the settings I have ticked 'Enable summary indexing'

Saved Search

 

index=email sourcetype=cisco:esa:textmail 
| stats values(action) as action, values(dest) as dest, values(duration) as duration, values(file_name) as file_name, values(message_id) as message_id, values(recipient) as recipient, dc(recipient) as recipient_count, values(recipient_domain) as recipient_domain, values(src) as src, values(src_user) as src_user, values(src_user_domain) as src_user_domain, values(message_subject) as subject, values(tag) as tag, values(url) as url, values(user) AS user values(vendor_product) as vendor_product, values(vendor_action) as filter_action, values(reputation_score) as filter_score BY internal_message_id

 

 

Thanks,

Dave

0 Karma
1 Solution
Get Updates on the Splunk Community!

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...