Splunk Dev

Hot to group message events of Cisco ESA by two or more fields

makitos666
New Member

I want to group all the events generated by an email generated by cisco_esa.

A query that I usually make is the following:

index="cisco_esa" mid="111351394" host="10.1.1.1"| stats list(_raw) AS events BY mid 

The question is that I group the events by MID, but it is not a common element, in fact there is no field in common between ALL the events of an email.

Most events have MID, some only have ICID or DICID, and there are some that contain MID and DCID or ICID. These last ones are used to group all the events of a single mail for their ICID and MID.

I have made the following consults to get the MID, ICID and host of each message by its source IP (dest)

index="cisco_esa" 
    [search index="cisco_esa"
        [search index="cisco_esa" 
            [search index="cisco_esa" dest=* protocol=SMTP | where isnotnull(icid) | table ICID,host]
        | where isnotnull(MID) | stats list(_raw) AS events by icid,host,MID | return 10000 $MID $icid] 
    | table icid,MID,host]
| table icid,MID,host | dedup icid,MID,host

Do you know how I could, with a single search, show ALL the events related to a mail message?

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...