Splunk Search

search requires stitching together two distinct events from a single sourcetype

danesh_shah
New Member

i require some assistance in my search query where i need to search a mail log to extract the highest recipients by message size based upon a unique common id.

as i am able to search events by the size field to see the values of message size from the senders addresses but i am unable to search this by the recipients address including to show the unique ID.

so i need to combine these two events first showing the message size and then the recipient addresses based upon a common queue ID. i know the stats function is more beneficial than the transaction command as it is costly. Also i believe i am able to chart it through xyseries but i'm unsure how to put this together as i have tried a various types of stats commands trying to put this together but i have a strong feeling i'm not executing it correctly

0 Karma

renjith_nair
Legend

@danesh_shah ,

Did you try stats values(recipient ) as recipient ,values(senders) as senders,max(message_size) by unqiue_id

If its not working, would it be possible to share some sample events after masking any sensitive data?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

danesh_shah
New Member

Hi - Thanks, how can i produce this as a chart to show each value i.e. message size, unique ID and the recipient address?

0 Karma

danesh_shah
New Member

i can visualise this as a chart but it only displays the chart over unique id by message size i need to show the recipients also

0 Karma

danesh_shah
New Member

index=maildata sourcetype="email_log"
| stats values(from) as senders ,values(to) as recipients,max(size) as "Message SIze" by qid
| rename qid as "Unique ID"
| sort 10 -"Message Size"

0 Karma

renjith_nair
Legend

@danesh_shah , it will be helpful if you have a sample events for both sender and recipient event. Please mask any sensitive information if needed

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...