I've been able to extract Postfix Queue ID's out of sourcetype="postfix_syslog" however often logs have multiple Queue ID's, and I'd like to extract the ID's, and use them to build transaction across postfix log events, events where postfix hands the logs off to another process, such as amavis and when one MTA hands the message to another server in the farm, allowing me to build the complete transaction of a mail message from acceptance at the border, filtering and final delivery! Has anyone been able to write an extraction the takes events with two Queue ID's and correctly maps the "Secondary" to the "Primary" in a related event?
Thanks
I think you're looking for the transaction feature: http://www.splunk.com/base/Documentation/4.0.9/Knowledge/Abouttransactions
Transactions combine together multiple events with some automatically created fields like how long the transaction took.
They can be defined ad-hoc as part of a search: http://www.splunk.com/base/Documentation/4.0.9/SearchReference/Transaction or the
Or they can be stored/persisted in configuration: http://www.splunk.com/base/Documentation/4.0.9/Knowledge/Definetransactions
Can you add a sample line(s) from the log you're trying to use? I think you're asking about how to create a transaction when there are multiple QID values in the same log line, but seeing examples of the specific events you're trying to handle will be helpful to clarify.
I think you're looking for the transaction feature: http://www.splunk.com/base/Documentation/4.0.9/Knowledge/Abouttransactions
Transactions combine together multiple events with some automatically created fields like how long the transaction took.
They can be defined ad-hoc as part of a search: http://www.splunk.com/base/Documentation/4.0.9/SearchReference/Transaction or the
Or they can be stored/persisted in configuration: http://www.splunk.com/base/Documentation/4.0.9/Knowledge/Definetransactions
Jrodmap,
The problem is not so easy and doc doesn't help. I've been doing the same here with a prospect customer. Transaction can't fully help becuse the several events to correlate never have ALL the same fields needed to "transaction" command. The transaction flows from one log to the other, and the startling identifying field (queue_id) then must be linked to the "from" field and a "message_id" in the amavis logs.
So, how is it possible to link events correlated from a chain of different fields?
Regards,
marco
So what's the question, how to extract mulitple Q ID's? How to build a transaction?