Consider email headers which show all the steps involved in getting the email item from where it was sent to where it is going, give or take spoofing and other whimsy. Is there a search in Splunk to display all the systems which have handled a particular event, from the original forwarder (easy), via any and all intermediate forwarders (less so...). The value of this would be to identify a possibly misconfigured system somewhere in what could be a complex chain, or where you have different intermediate forwarders depending on where you are in the network. My feeling is that this is not logged, but I could be wrong, and even so, there may be a way to assemble the path an event has taken somehow. Thanks!
... View more