Splunk Search
Highlighted

Difficult SMTP log search. Help!

Communicator

I'm trying to come up with a search that would help me find emails that share the same subject line but the IP address of the sender varies from message to message (as if a bot network sends a SPAM campaign).

So far I'm able to get the base information via this search:

index=smtp | transaction qid keepevicted=true | table subject,ip

I'm not sure if there's a way in Splunk to evaluate the common "subject" against the different IP addresses, with the results just showing the common subjects that have different IP addresses. Or should I look to export this table to a CSV then write another script that would parse the CSV?

Any thoughts or input would be great! Thanks!!

Tags (1)
0 Karma
Highlighted

Re: Difficult SMTP log search. Help!

Builder

This comes to mind:

| table count(ip),count(distinct) by subject | top
0 Karma
Highlighted

Re: Difficult SMTP log search. Help!

Splunk Employee
Splunk Employee

almost: ...|stats count(ip),distinct_count(ip) by subject

0 Karma
Highlighted

Re: Difficult SMTP log search. Help!

Communicator

Actually the distinct count on IP by subject seems to do it. Thanks gkanapathy!!

0 Karma
Highlighted

Re: Difficult SMTP log search. Help!

Communicator

Hey gkanapathy, could you make your comment an answer so I could vote for it answering my question?

0 Karma
Highlighted

Re: Difficult SMTP log search. Help!

Splunk Employee
Splunk Employee

If you are looking to see a common subject across several IP address then you just need to include the subject as you would like to search for it. Taking your search example, have you tried the following?

index=smtp "subject" | transaction qid keepevicted=true | table subject,ip

If you want to search for multiple subjects with the IP addresses shown, you could separate the subjects by using the OR operator within the search string.

index=smtp "subject1" OR "subject2" | transaction qid keepevicted=true | table subject,ip