Postfix Queue ID

[thartmann]

I've been able to extract Postfix Queue ID's out of sourcetype="postfix_syslog" however often logs have multiple Queue ID's, and I'd like to extract the ID's, and use them to build transaction across postfix log events, events where postfix hands the logs off to another process, such as amavis and when one MTA hands the message to another server in the farm, allowing me to build the complete transaction of a mail message from acceptance at the border, filtering and final delivery! Has anyone been able to write an extraction the takes events with two Queue ID's and correctly maps the "Secondary" to the "Primary" in a related event?

Thanks

[Justin_Grant]

Can you add a sample line(s) from the log you're trying to use? I think you're asking about how to create a transaction when there are multiple QID values in the same log line, but seeing examples of the specific events you're trying to handle will be helpful to clarify.

[jrodman · Accepted solution]

I think you're looking for the transaction feature: http://www.splunk.com/base/Documentation/4.0.9/Knowledge/Abouttransactions

Transactions combine together multiple events with some automatically created fields like how long the transaction took.

They can be defined ad-hoc as part of a search: http://www.splunk.com/base/Documentation/4.0.9/SearchReference/Transaction or the

Or they can be stored/persisted in configuration: http://www.splunk.com/base/Documentation/4.0.9/Knowledge/Definetransactions

[marcoscala]

Jrodmap,
The problem is not so easy and doc doesn't help. I've been doing the same here with a prospect customer. Transaction can't fully help becuse the several events to correlate never have ALL the same fields needed to "transaction" command. The transaction flows from one log to the other, and the startling identifying field (queue_id) then must be linked to the "from" field and a "message_id" in the amavis logs.

So, how is it possible to link events correlated from a chain of different fields?

Regards,
marco

[Mick]

So what's the question, how to extract mulitple Q ID's? How to build a transaction?