Splunk Search

How do you configure splunk to extract fields from SMTP Message Transaction Logs?

aphanmanivong
New Member

We currently use Cisco IronPorts and are sending the Message Transaction Logs via syslog to Splunk. I couldn't find the exact app for the IronPort, but I tried installing Cisco ESA as it had references for email. Does Splunk have rules already built-in to extract fields from Message Transaction Logs? I have also tried creating field-extractions, but they do not appear to be working 100% of the time. I am open to any suggestions.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

The best advice I can give you without seeing any sample logs, is to not depend on an app at all. Learn about how transforms.conf can change your sourcetype for the specific type of log that appears in syslog. From there, learn field extraction and grab the fields that matter for your events, finally, chart it and build your views. Then you will have your apps. Learning core Splunk and its capabilities will be a boon to you. There are numerous examples on answers.splunk.com that show how to transform syslog based on the event patterns, and numerous tutorials on field extraction. Finally, go take the Splunk tutorial and you will be off and running! Good luck!

woodcock
Esteemed Legend

According to the dox (http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/Listofpretrainedsourcetypes ), Splunk supports 3 MTA types automatically; you just have to configure the input and set the sourcetype to match: {exim_main, postfix_syslog, sendmail_syslog}

0 Karma

muebel
SplunkTrust
SplunkTrust

do you have a log sample, and the extractions you have tried so far?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...