Splunk Search

Sendmail transactions

htaylor
New Member

When searching for email addresses in our sendmail logs, it helps to see the full transaction by using the queue id (qid) field.

Search command:

sourcetype="sendmail_syslog" | transaction fields=qid maxspan=1m maxpause=30s | search bob@example.com

Example output:

Apr 16 12:35:55 server1 sendmail[13643]: o3GHZsNn013643: from=<mary@example.com>, size=1126, class=0, nrcpts=1, msgid=<432872bdb01004161035p451651bja75b78adadf43680@mail.example.com>, proto=ESMTP, daemon=MTA, relay=mail.example.com [192.168.1.1]
Apr 16 12:35:56 server1 sendmail[13656]: o3GHZsNn013643: to=<bob@example.com>, delay=00:00:01, xdelay=00:00:00, mailer=smtp, pri=121126, relay=mail.example.com [192.168.1.1], dsn=2.0.0, stat=Sent (Ok: queued as 2DA7D50210)

Fields:

host=server1 | sourcetype=sendmail_syslog | source=/var/log/maillog | to=<bob@example.com> | from=<mary@example.com> | relay=[192.168.1.1] | relay=mail.example.com | size=1126 | delay=00:00:01 | process=sendmail | qid=o3GHZsNn013643


Currently transactions take a long time to process, especially if I am looking at an entire days worth of email records to search for one email address. Can someone show me which search options would allow me to search for the email address first then pass the qid results list to a new search and run a transaction against that. sourcetype="sendmail_syslog" bob@example.com | fields qid …?

I have looked at this question already: "http://answers.splunk.com/questions/284/subsearch-like-correlated-subquery-in-sql", but it still does not provide a clear answer. Do I use a subsearch or use the map command and how would I use it in this example?

Tags (2)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee
sourcetype=sendmail_syslog [ search sourcetype="sendmail_syslog" bob@example.com | dedup qid | fields qid ] | transaction fields=qid maxspan=1m maxpause=30s

should do it better

View solution in original post

carasso
Splunk Employee
Splunk Employee

The searchtxn was created for this exact use case. It also does the transitive closure when you have multiple fields involved and not just one. To do that yourself you'd need to have a subsearch of a subsearch, etc.

| searchtxn email to=bob@example.com

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
sourcetype=sendmail_syslog [ search sourcetype="sendmail_syslog" bob@example.com | dedup qid | fields qid ] | transaction fields=qid maxspan=1m maxpause=30s

should do it better

htaylor
New Member

This works great. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...