Splunk Search

Difficult SMTP log search. Help!

castle1126
Communicator

I'm trying to come up with a search that would help me find emails that share the same subject line but the IP address of the sender varies from message to message (as if a bot network sends a SPAM campaign).

So far I'm able to get the base information via this search:

index=smtp | transaction qid keepevicted=true | table subject,ip

I'm not sure if there's a way in Splunk to evaluate the common "subject" against the different IP addresses, with the results just showing the common subjects that have different IP addresses. Or should I look to export this table to a CSV then write another script that would parse the CSV?

Any thoughts or input would be great! Thanks!!

Tags (1)
0 Karma

Rob
Splunk Employee
Splunk Employee

If you are looking to see a common subject across several IP address then you just need to include the subject as you would like to search for it. Taking your search example, have you tried the following?

index=smtp "subject" | transaction qid keepevicted=true | table subject,ip

If you want to search for multiple subjects with the IP addresses shown, you could separate the subjects by using the OR operator within the search string.

index=smtp "subject1" OR "subject2" | transaction qid keepevicted=true | table subject,ip

fk319
Builder

This comes to mind:

| table count(ip),count(distinct) by subject | top
0 Karma

castle1126
Communicator

Hey gkanapathy, could you make your comment an answer so I could vote for it answering my question?

0 Karma

castle1126
Communicator

Actually the distinct count on IP by subject seems to do it. Thanks gkanapathy!!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

almost: ...|stats count(ip),distinct_count(ip) by subject

0 Karma