Splunk Search

Searching msexchange logs

wfarooq124
New Member

is there any splunk query to search for send, recipient and subject in msexchange email logs? I know there is msexchange app but could it be done via simple query, regex? thanks for your help

0 Karma

3no
Communicator

You will want to group all your logs by "internal_message_id" or "MID" to do so, you can use the "transaction" command :

 Index=email sourcetype=msexchange | transaction MID 

As you'll see transaction is quiet slow, I'll recommand using a groupby instead, It should look something like this :

Index=email sourcetype=msexchange  | stats values(recipient) AS recipient, values(sender) AS sender, values(subject) AS subject by MID

3no

0 Karma

to4kawa
Ultra Champion

what's session field?

0 Karma

wfarooq124
New Member

@to4kawa this is regarding sourcetype=MSExchange:2013:MessageTracking so basically using it to parse send receive and subject

0 Karma

to4kawa
Ultra Champion
0 Karma

wfarooq124
New Member

@to4kawa thanks for your response I am looking for email sender, recipient and subject fields

0 Karma

to4kawa
Ultra Champion

what's the results of searching sender@domain OR subject OR recipient@domain?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...