Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About silverlink34
silverlink34
Explorer
Member since:
10-03-2018
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 1 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-03-2018 |
Activity Feed
- Posted Re: Why is my query using the transaction command missing some events? on Splunk Search. 11-06-2018 08:53 AM
- Posted Why is my query using the transaction command missing some events? on Splunk Search. 11-02-2018 10:23 AM
- Tagged Why is my query using the transaction command missing some events? on Splunk Search. 11-02-2018 10:23 AM
- Tagged Why is my query using the transaction command missing some events? on Splunk Search. 11-02-2018 10:23 AM
- Posted Re: In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 11-02-2018 10:01 AM
- Posted Re: In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 10-08-2018 08:43 AM
- Posted Re: In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 10-05-2018 02:01 PM
- Posted Re: In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 10-04-2018 05:35 AM
- Posted Re: In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 10-03-2018 01:48 PM
- Posted Re: In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 10-03-2018 01:47 PM
- Posted In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 10-03-2018 07:36 AM
- Tagged In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 10-03-2018 07:36 AM
- Tagged In a Splunk search, how do you match "from address" and "to address" event IDS to obtain table of emails? on Reporting. 10-03-2018 07:36 AM
Topics I've Started
11-06-2018
08:53 AM
Awesome thank you! That works great.
... View more
11-02-2018
10:23 AM
Here is ALL of the data that is actually in the logged transaction:
Nov 1 15:41:18 mail qmail: 1541101278.677067 new msg 1048820 (19a97640-de0e-11e8-a1a3-f74156095854)
Nov 1 15:41:18 mail qmail: 1541101278.677088 info msg 1048820: bytes 5247 from <fromemail@fdomain.com> qp 1854 uid 64011
Nov 1 15:41:18 mail qmail: 1541101278.677096 starting delivery 626443: msg 1048820 to local tdomain.com-recipient1@todomain.com
Nov 1 15:41:18 mail qmail: 1541101278.677113 starting delivery 626444: msg 1048820 to remote recipient2@trdomain.com
Nov 1 15:41:18 mail qmail: 1541101278.677131 starting delivery 626445: msg 1048820 to remote recipient3@trdomain.com
Nov 1 15:41:18 mail qmail: 1541101278.739330 delivery 626443: success: mlpid_1862/did_0+0+1/
Nov 1 15:41:20 mail qmail: 1541101280.703177 delivery 626444: success: 0.0.0.1_accepted_message./Remote_host_said:_250_ujhK1y00D03Y9o001jhLWU_mail_accepted_for_delivery/
Nov 1 15:41:31 mail qmail: 1541101291.640138 delivery 626445: success: 0.0.0.2_accepted_message./Remote_host_said:_250_OK_id=1gIIqQ-001DRc-3G/
Nov 1 15:41:31 mail qmail: 1541101291.640224 end msg 1048820
I have 2 field extractions: msg_id that pulls value "1048820" and delivery_id that pulls the values: 626443,626444,626445 for each instance.
When I search
> host = "1.1.1.1"| transaction msg_id startswith="new msg" endswith="end msg" maxpause=1h connected=false
My transactions are grouped together properly however the lines with "delivery $delivery_id$: success:......" are not present.
Example:
Nov 1 15:41:18 mail qmail: 1541101278.677067 new msg 1048820 (19a97640-de0e-11e8-a1a3-f74156095854)
Nov 1 15:41:18 mail qmail: 1541101278.677088 info msg 1048820: bytes 5247 from <fromemail@fdomain.com> qp 1854 uid 64011
Nov 1 15:41:18 mail qmail: 1541101278.677096 starting delivery 626443: msg 1048820 to local tdomain.com-recipient1@todomain.com
Nov 1 15:41:18 mail qmail: 1541101278.677113 starting delivery 626444: msg 1048820 to remote recipient2@trdomain.com
Nov 1 15:41:18 mail qmail: 1541101278.677131 starting delivery 626445: msg 1048820 to remote recipient3@trdomain.com
Nov 1 15:41:31 mail qmail: 1541101291.640224 end msg 1048820
I am piping the transactions into a table like so:
> host = "1.1.1.1"| transaction msg_id startswith="new msg" endswith="end msg" maxpause=1h connected=false | table qmail_from_address, qmail_to_address, qmail_delivery_status, msg_id, delivery_id _time
But since the status messages are not present in the transaction search, the qmail_delivery_status column is empty.
Curious enough, when I change my transaction search to include delivery_id as a field, I only get ONE delivery in it, with the status, and the other delivered recipients do not show up.
Example:
Nov 1 15:41:18 mail qmail: 1541101278.677067 new msg 1048820 (19a97640-de0e-11e8-a1a3-f74156095854)
Nov 1 15:41:18 mail qmail: 1541101278.677088 info msg 1048820: bytes 5247 from <fromemail@fdomain.com> qp 1854 uid 64011
Nov 1 15:41:18 mail qmail: 1541101278.677131 starting delivery 626445: msg 1048820 to remote recipient3@trdomain.com
Nov 1 15:41:31 mail qmail: 1541101291.640138 delivery 626445: success: 0.0.0.2_accepted_message./Remote_host_said:_250_OK_id=1gIIqQ-001DRc-3G/
Nov 1 15:41:31 mail qmail: 1541101291.640224 end msg 1048820
If I can figure out how to get the delivery status lines in my transaction search, my table will populate correctly.
What am I doing wrong?
... View more
11-02-2018
10:01 AM
Please close this question. The suggestions to use the transaction search command have prompted me to gather information in a different manner, which has spawned a new question. I will ask the new question separately. Thank you for all time involved.
... View more
10-08-2018
08:43 AM
@renjith.nair, thank you for putting the time into creating dummy data generation to help me find a solution. Your example you provided with the results it yielded is exactly what I am looking for.
I have further fixed more of the issue by extracting a new field, called "To_or_From_MSD_Number" which uses specific regex to capture the MSD number ONLY if it is a To or From email event. This has given me near exactly the results I needed when using your new search query.
However, what I have found is that this email application will re-use the MSD number further in the same day, making results have multiple values in the From and To columns. Due to this unfortunate detail, I wonder if this is beyond the scope of Splunk's ability. The search query would have to somehow get the msd matched To and From events that are within the same hour. Or maybe I could throw the source ip that is in the To event into the query somewhere to isolate the results.
Here is an example, where I specified 1 MSD number because it has been used twice already today:
search query:
host = hostIp To_or_From_MSD_Number="10092" | stats values(Email_From_Address) as From,values(Email_To_Address) as To, count by To_or_From_MSD_Number|where count>1| fields - count
Results:
To_or_From_MSD_Number: From: To:
10092 from@first.com to@first.com
from@second.com to@second.com
And here would be the actual To and From events from the results:
Oct 8 06:27:19 mail msd[10092] MAIL command received, args: FROM: from@first.com
Oct 8 06:27:19 mail msd[10092] RCPT command received (1.1.1.1), args: TO: to@first.com
Oct 8 08:20:10 mail msd[10092] MAIL command received, args: FROM: from@second.com
Oct 8 08:20:11 mail msd[10092] RCPT command received (2.2.2.2), args: TO: to@second.com
After looking at the events here I noticed that the source ip in the To events differs, is it possible to separate the joined results from our search query by using that source ip? (meaning the 1.1.1.1 and the 2.2.2.2 ips in the To events)
The results I would hope could be achievable would look something like this:
Source IP: MSD Number: From: To:
1.1.1.1 10092 from@first.com to@first.com
2.2.2.2 10092 from@second.com to@second.com
I apologize for this difficult request. I will accept that what I ask for is over-complicated and not achievable if necessary.
... View more
10-05-2018
02:01 PM
I thank you all again for your continued support. I have found out why my results are not as expected, which is to two large factors:
Even though the Email_To_MSD_Number and Email_From_MSD_Number fields are always present in ONLY an email To or From event, the generic msd_number field is found not only in Email To and From events, but other events as well. This results in our tested query to give rows without a To or From email address, because when using "by msd_number" it includes the rows that don't have an Email_From_Address or Email_To_Address.
I have found that the msd_number is re-used later in the day, so it is not entirely unique per every message. I would almost have to make sure the Email_From_Address event and Email_To_Address events are within the same hour to ensure the msd_number is unique between them.
... View more
10-04-2018
05:35 AM
Yes sir! Here are the two events I am pulling information from, and the fields pulled from them:
"<22>Oct 3 15:00:17 mail msd[24056]: MAIL command received, args: FROM:"
Email_From_MSD_Number = 24056
Email_From_Address = silverlink34@domain.com
msd_number = 24056
"<22>Oct 3 15:00:17 mail msd[24056]: RCPT command received (0.0.0.0), args: TO:"
Email_To_MSD_Number = 24056
Email_To_Address = splunkhelp@domain.com
msd_number = 24056
And the results I am trying to get are:
Column1:From Column2:To Column3:MSD Number
silverlink34@domain.com splunkhelp@domain.com 24056
... and the rest of the rows from the list of results, I want ALL of the Froms, Tos, and MSD numbers.
I ONLY want rows that have all three columns, do not want rows that have only From/To/ or MSD Number.
And of course once I can figure this out I can span off into my other desired results.
... View more
10-03-2018
01:48 PM
The events are separate. I am trying to put together the search string with the count>1 suggestion you have proposed. Thank you for helping! I'll let you know where it gets me.
... View more
10-03-2018
01:47 PM
Thank you for your suggestion, I do appreciate your input. However, this gives the same result as my query does. Each event that contains the Email_From_Address or Email_To_Address already contains the msd_number in it, so the results in the stats list does not change. The results from my query returns every msd_number found, but these results have several rows that are missing the Email_From_Address and/or the Email_To_Address. I am unsure of how to only show results that have the same msd_number that is in the Email_From_Address and the Email_To_Address. I will try @renjith.nair's approach and see what that does.
... View more
10-03-2018
07:36 AM
I have a qmail type email server sending in SMTP logs. The log entries have separate events for the "from email address" and the "to email address" for an email transaction, but they share the same MSD number (message id). I've located these specific events and extracted the following fields:
Email_From_Address
Email_To_Address
Email_From_MSD_Number
Email_To_MSD_Number
Email_To_Domain
Also, I extracted a generic field "msd_number", which will match to both Email_From_MSD_Number and Email_To_MSD_Number
I was hoping that with these fields I could get the following data: (using different searches of course.)
-table with the top 10 senders with count of total emails sent (this one I can manage, simply count the Email_From_Address by Email_From Address)
-specified Email_From_Address or Email_To_Address and find all corresponding emails from or to based on which one is searched (for example if searching the Email From Address show all Email To Addresses that was sent from the specified Email From Address, or vice versa if Email To Address is specified)
-table with top 10 Email_From_Address count to Email_To_Domain (example: From column: [email@domain.com] To column: [gmail.com] # emails sent column: [25])
-setup an interactive search dashboard where you can specify the Email From, Email To, or MSD Number and get a list of events with the corresponding data, such as a search for the Email From will return the Emails To and MSD numbers.
The problem is that I don't know how to match up the corresponding To or From address fields by using the matching MSD number field. I started trying by using the search:
host = hostIp | stats list(Email_From_Address) list(Email_to_email_address) by msd_number
This search DOES contain rows with a matching email from and email to by the MSD number, however it also has rows that don't have matching msd_numbers. I don't want those rows.
I appreciate any time and efforts you may put into helping me understand and find the solution. Thank you kindly.
... View more
- Tags:
- splunk-light
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
