MID is extracted as internal_message_id - you should use this field when grouping logs back together via transaction or stats. Please note that the issue of having to group logs for a given mail back together stems from the fact that the Ironport ESA add-on does handle this when Splunk is configured to receive text mail logs via rsyslog. This is a non-issue when Splunk is configured to pick up text mail logs via a monitored input (i.e. Ironport is configured to scp/ftp logs to a monitored location), as all logs for a given mail are already grouped together. Although the field extractions defined in the Ironport ESA add-on do work correctly in both ingestion scenarios, an unfortunate side effect of ingesting logs via rsyslog is that the Email CIM datamodel does not get populated correctly. I consider this to be a bug with the add-on and have filed a support case to have the documentation updated to note the issue. ... View more