Splunk Search

Difficult SMTP log search. Help!

castle1126
Communicator

I'm trying to come up with a search that would help me find emails that share the same subject line but the IP address of the sender varies from message to message (as if a bot network sends a SPAM campaign).

So far I'm able to get the base information via this search:

index=smtp | transaction qid keepevicted=true | table subject,ip

I'm not sure if there's a way in Splunk to evaluate the common "subject" against the different IP addresses, with the results just showing the common subjects that have different IP addresses. Or should I look to export this table to a CSV then write another script that would parse the CSV?

Any thoughts or input would be great! Thanks!!

Tags (1)
0 Karma

Rob
Splunk Employee
Splunk Employee

If you are looking to see a common subject across several IP address then you just need to include the subject as you would like to search for it. Taking your search example, have you tried the following?

index=smtp "subject" | transaction qid keepevicted=true | table subject,ip

If you want to search for multiple subjects with the IP addresses shown, you could separate the subjects by using the OR operator within the search string.

index=smtp "subject1" OR "subject2" | transaction qid keepevicted=true | table subject,ip

fk319
Builder

This comes to mind:

| table count(ip),count(distinct) by subject | top
0 Karma

castle1126
Communicator

Hey gkanapathy, could you make your comment an answer so I could vote for it answering my question?

0 Karma

castle1126
Communicator

Actually the distinct count on IP by subject seems to do it. Thanks gkanapathy!!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

almost: ...|stats count(ip),distinct_count(ip) by subject

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...