Postfix_logs_format

abusayeed · ‎02-27-2018

I have sent a mail. And mail server gives me logs like these.

Feb 27 11:30:11 mail postfix/qmgr[8620]: 24C4C681F19: from=[email protected], size=8814, nrcpt=1 (queue active)
Feb 27 11:30:11 mail postfix/amavis/smtp[50690]: 24C4C681F19: to=[email protected], relay=127.0.0.1[127.0.0.1]:10024, delay=2.1, delays=1.2/0.01/0/0.93, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as F3433681F7C)

I want to build a search based on the from address, but do stats on the status (separate counts for deffered, sent, reject etc.). Anyway I could make splunk realize these two events are related?

p_gurav · ‎03-01-2018

Hi,

This is answer will help you:
https://answers.splunk.com/answers/40922/postfix-logs.html

Postfix_logs_format

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Postfix_logs_format

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas