How do you configure splunk to extract fields from SMTP Message Transaction Logs?

[aphanmanivong]

We currently use Cisco IronPorts and are sending the Message Transaction Logs via syslog to Splunk. I couldn't find the exact app for the IronPort, but I tried installing Cisco ESA as it had references for email. Does Splunk have rules already built-in to extract fields from Message Transaction Logs? I have also tried creating field-extractions, but they do not appear to be working 100% of the time. I am open to any suggestions.

[dmaislin_splunk]

The best advice I can give you without seeing any sample logs, is to not depend on an app at all. Learn about how transforms.conf can change your sourcetype for the specific type of log that appears in syslog. From there, learn field extraction and grab the fields that matter for your events, finally, chart it and build your views. Then you will have your apps. Learning core Splunk and its capabilities will be a boon to you. There are numerous examples on answers.splunk.com that show how to transform syslog based on the event patterns, and numerous tutorials on field extraction. Finally, go take the Splunk tutorial and you will be off and running! Good luck!

[woodcock]

According to the dox (http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/Listofpretrainedsourcetypes ), Splunk supports 3 MTA types automatically; you just have to configure the input and set the sourcetype to match: {exim_main, postfix_syslog, sendmail_syslog}

[muebel]

do you have a log sample, and the extractions you have tried so far?