There is a Proofpoint add-on and we have it installed, but we need kind of bulk processing capabilities. For example, list all messages from a given sender, IP etc. ... View more

Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.436109+00:00 host filter_instance1[1394]: rprt s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=mail cmd=env_from value=sender@company.com size= smtputf8= qid=44pnhtdtkf-1 tls= routes= notroutes=tls_fallback host=host123.company.com ip=10.10.10.10 Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.438453+00:00 host filter_instance1[1394]: rprt s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=mail cmd=env_rcpt r=1 value=recipient.two@DifferentCompany.net orcpt=recipient.two@DifferentCompany.NET verified= routes= notroutes=RightFax,default_inbound,journal Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.440714+00:00 host filter_instance1[1394]: rprt s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=mail cmd=env_rcpt r=2 value=recipient.one@company.com orcpt=recipient.one@company.com verified= routes=default_inbound notroutes=RightFax,journal Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.446326+00:00 host filter_instance1[1394]: rprt s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=session cmd=data from=sender@company.com suborg= Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.446383+00:00 host filter_instance1[1394]: rprt s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=session cmd=data rcpt=recipient.two@DifferentCompany.net suborg= Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.446405+00:00 host filter_instance1[1394]: rprt s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=session cmd=data rcpt=recipient.one@company.com suborg= Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.446639+00:00 host filter_instance1[1394]: info s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=session cmd=data rcpt_routes= rcpt_notroutes=RightFax,journal data_routes= data_notroutes= Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.450566+00:00 host filter_instance1[1394]: info s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=session cmd=headers hfrom=sender@company.com routes= notroutes= Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.455141+00:00 host filter_instance1[1394]: info s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=mimelint cmd=getlint lint= Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.455182+00:00 host filter_instance1[1394]: info s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=mimelint cmd=getlint mime=1 score=0 threshold=100 duration=0.000 Feb 11 10:04:12 host.company.com 2025-02-11T15:04:12.455201+00:00 host filter_instance1[1394]: info s=44pnhtdtkf m=1 x=44pnhtdtkf-1 mod=mimelint cmd=getlint warn=0 ... View more

Thanks again ... View more

Thank you guys. This forum is really great. ... View more

Hi, I posted sample log entries. I am not sure how readable this is. ... View more

Nov 24 15:01:43 pphost.company.com 2024-11-24T04:01:43.100466+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv mod=session cmd=disconnect module= rule= action= helo=sendinghost msgs=1 rcpts=2 routes=allow_relay,default_inbound,internalnet duration=0.128 elapsed=100 Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.614350+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=mail cmd=msg module= rule= action=continue attachments=0 rcpts=2 routes=allow_relay,default_inbound,internalnet size=5441 guid=jAIwVNBFVxC8EycWPq7c1MicIX5v1om5 hdr_mid=<42y9nt2euv-1@pphost.company.com> qid=4AO403EC022673 hops-ip=10.20.30.40 subject="MESSAGE SUBJECT" duration=0.125 elapsed=0.127 Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.614025+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 cmd=send profile=mail qid=4AO403EC022673 rcpts=RECIPIENT1@company.com,RECIPIENT2@company.com Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.505939+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=session cmd=judge module=none rule=none Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.505617+00:00 pphost filter_instance1[1523]: info s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=dmarc cmd=run arc_result=none arc_result_detail=none arc_trusted_flag=0 arc_override=0 dmarc_detail="nothing to see here" dmarc_record=none dmarcverified= final_dmarc_result=none orig_dmarc_result=none auth_result=none original_auth_result= dyndmarc_override_id= dmarcoverride_type= Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.505346+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=dkimv cmd=run rule=none dkimresult=none spfheaderfromresult=none duration=0.000 Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.505036+00:00 pphost filter_instance1[1523]: info s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=spf cmd=run cmd=eob result=none Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.504665+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=mail cmd=attachment id=0 file=text.html mime=text/html type=html omime=text/html oext=html corrupted=0 protected=0 size=3550 virtual=0 sha256=11dbefae8a521d127ef990b45e998cae68184d56a3d657ee6661f11a8b048d85 a=0 duration=0.000 Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.499983+00:00 pphost filter_instance1[1523]: info s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=mimelint cmd=getlint warn=0 Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.499957+00:00 pphost filter_instance1[1523]: info s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=mimelint cmd=getlint mime=1 score=0 threshold=100 duration=0.000 Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.499913+00:00 pphost filter_instance1[1523]: info s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=mimelint cmd=getlint lint= Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.497214+00:00 pphost filter_instance1[1523]: info s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=session cmd=headers hfrom=noreply@company.com routes= notroutes=* Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.495249+00:00 pphost filter_instance1[1523]: info s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=session cmd=data rcpt_routes=default_inbound rcpt_notroutes=journal data_routes= data_notroutes= Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.494969+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=session cmd=data rcpt=recipeint2@company.com suborg= Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.494950+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=session cmd=data rcpt=recipient1@company.com suborg= Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.494892+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=session cmd=data from=noreply@company.com suborg= Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.489936+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=mail cmd=env_rcpt r=2 value=recipient2@company.com orcpt=RECIPIENT2@company.com verified= routes=default_inbound notroutes=journal Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.488974+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=mail cmd=env_rcpt r=1 value=recipient1@company.com orcpt=RECIPIENT1@company.com verified= routes=default_inbound notroutes=journal Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.487458+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv m=1 x=42y9nt2euv-1 mod=mail cmd=env_from value=noreply@company.com ofrom=NoReply@company.com size= smtputf8= qid=42y9nt2euv-1 tls= routes= notroutes=tls_fallback host=sendinghost.company.com ip=10.20.30.40 Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.486235+00:00 pphost filter_instance1[1523]: info s=42y9nt2euv mod=mail cmd=helo value=sendinghost extended=1 routes= Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.484673+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv mod=session cmd=resolve host=sendinghost.company.com resolve=ok reverse=sendinghost.company.com routes=allow_relay notroutes= Nov 24 15:00:03 pphost.company.com 2024-11-24T04:00:03.065376+00:00 pphost filter_instance1[1523]: rprt s=42y9nt2euv mod=session cmd=connect ip=10.20.30.40 country=** lip=50.60.70.80 prot=smtp:smtp hops_active=f routes=internalnet notroutes=firewallsafe,outbound,pp_spoofsafe,spfsafe,tls,xclient_trusted perlwait=0.002 ... View more

Thank you marnall. I will try this approach and report back. ... View more

Hi,   Thank you guys. This helped a lot. I am sorry for late reply. I was away for a weekend. The primary business case is to count number of emails and their sizes (grouped by sender's SMTP address) sent from Proofpoint SER to internal SMTPs. The secondary case is to get message level information about these messages (from, to, number of recipients, subject, size). These are two independent Splunk queries. ... View more

Hi gcusello, Thanks for a quick reply. Unfortunately this approach in its entirety will not work as there are more events that these two in a "send an email" group of events. All events except the first one from the two I posted have both hdr_mid and qid fields so I group them by these fields in stats. Also, only these two events i posted have rprt set of fields with s in them. I was thinking about somehow matching these two events on s and qid so I can insert field with hdr_mid value into first event. This will allow me to have all events with hdr_mid and qid in them so grouping by hdr_mid and qid in final stats statement will allow to pull list of recipients. BTW, the values statement below is exactly what I was looking for to pull rctps field from proper event. values(eval(if(cmd="send",rcpts,""))) AS rcpts   ... View more