I am working with IronPort logs and oddly the mailto and mailfrom fields are not in the same records. So what I am looking to do is create a search similar to:
index=email sourcetype=ironport mailto=%form_var%
which will result in a fields that I can use (icid) to then find the mailfrom field. So I am thinking about a subsearch like:
index=email sourcetype=ironport icid=<number from first search>
So I am wondering two things:
I would like a table of date mailto mailfrom as a very end result.
Thanks for the guidance!
Your layout would look like this:
index=email sourcetype=ironport [search index=email sourcetype=ironport mailto=%form_var% | table icid]
Your subsearch ends up giving you a clause that looks like (icid=1 OR icid=2 OR...) based on the results of that search. This gets applied to your main search, and you get the results you're looking for.
(icid=1 OR icid=2 OR...)
View solution in original post
I was dubious that this would do it, but in fact it does. Thanks so much!