You are probably operating inside of a search head cluster. If so, try using curl to access the REST endpoints against the literal name of one of the search heads. For example: instead of going to https://mysplunk.company.com, go to https://mysearchhead01.company.com via Curl like this curl -k -u alice:pass https://mysearchhead01.company.com/servicesNS/alice/myapp/saved/searches/mysearch \ -d search="index=mai*" ... View more

The transaction on MID isn't enough, because the different models of ESA spawn new MID's and reference the original MID as "internal_message_id". Instead, a more complex union is required to accomplish the Ironport logs self-join. | union [ search index=ironport mid=* (message_size=* OR internal_message_id=* OR sender=* OR recipient=* OR subject=*) | eval message_size_mb=(message_size_mb/1024/1024) | fields mid, message_size_mb, internal_message_id, sender, recipient, subject, _time | stats min(_time) as _time values(*) as * by mid] [ search index=ironport file_name=* | rename mid as internal_message_id | stats min(_time) as _time values(file_name) as file_names by internal_message_id | fields internal_message_id file_names _time] | stats values(*) as * min(_time) as _time by internal_message_id | search mid=* message_size_mb=* | table _time, mid, internal_message_id, sender, subject, recipient, message_size_mb, file_names | collect index=ironport sourcetype=ironport:summary addtime=false This search will look at ironport logs in the index=ironport which have MID=* and other key values. Then using this as a union change the MID as internal_message_ID and search again for associated records. Finally, collect the data into a new sourcetype=ironport:summary and use the original data time for the summary to preserve the event's original time. Run this search as a scheduled search to populate email data either for a data model or to query directly on the new summarized information. ... View more

Thank you sharing great answers ... View more

The transaction on MID isn't enough, because the different models of ESA spawn new MID's and reference the original MID as "internal_message_id". Instead, a more complex union is required to accomplish the Ironport logs self-join. | union [ search index=ironport mid=* (message_size=* OR internal_message_id=* OR sender=* OR recipient=* OR subject=*) | eval message_size_mb=(message_size_mb/1024/1024) | fields mid, message_size_mb, internal_message_id, sender, recipient, subject, _time | stats min(_time) as _time values(*) as * by mid] [ search index=ironport file_name=* | rename mid as internal_message_id | stats min(_time) as _time values(file_name) as file_names by internal_message_id | fields internal_message_id file_names _time] | stats values(*) as * min(_time) as _time by internal_message_id | search mid=* message_size_mb=* | table _time, mid, internal_message_id, sender, subject, recipient, message_size_mb, file_names | collect index=ironport sourcetype=ironport:summary addtime=false This search will look at ironport logs in the index=ironport which have MID=* and other key values. Then using this as a union change the MID as internal_message_ID and search again for associated records. Finally, collect the data into a new sourcetype=ironport:summary and use the original data time for the summary to preserve the event's original time. Run this search as a scheduled search to populate email data either for a data model or to query directly on the new summarized information. ... View more