Difficult SMTP log search. Help!

[castle1126]

I'm trying to come up with a search that would help me find emails that share the same subject line but the IP address of the sender varies from message to message (as if a bot network sends a SPAM campaign).

So far I'm able to get the base information via this search:

index=smtp | transaction qid keepevicted=true | table subject,ip

I'm not sure if there's a way in Splunk to evaluate the common "subject" against the different IP addresses, with the results just showing the common subjects that have different IP addresses. Or should I look to export this table to a CSV then write another script that would parse the CSV?

Any thoughts or input would be great! Thanks!!

[Rob]

If you are looking to see a common subject across several IP address then you just need to include the subject as you would like to search for it. Taking your search example, have you tried the following?

index=smtp "subject" | transaction qid keepevicted=true | table subject,ip

If you want to search for multiple subjects with the IP addresses shown, you could separate the subjects by using the OR operator within the search string.

index=smtp "subject1" OR "subject2" | transaction qid keepevicted=true | table subject,ip

[fk319]

This comes to mind:

| table count(ip),count(distinct) by subject | top

[castle1126]

Hey gkanapathy, could you make your comment an answer so I could vote for it answering my question?

[castle1126]

Actually the distinct count on IP by subject seems to do it. Thanks gkanapathy!!

[gkanapathy]

almost: ...|stats count(ip),distinct_count(ip) by subject