Getting full mail transaction with Exim

[leonrtx]

I want to display all mail to and from a client, with the subject, relayed host and status in one dashboard. The dashboard has a form search where you enter a mail address. Using the transaction command works, but it takes to long to be usable. Here's my transaction search:

sourcetype="exim-mainlog" | transaction host,Exim_Message_ID | table exim_message_id,from_address,to_address,T,H

I tried using subsearches, but it doesn't work. Looks like subsearches might be broken in Splunk 5

sourcetype="exim-mainlog" [sourcetype="exim-mainlog" from_address="address" OR to_address="address" | table Exim_Message_ID]

Any other ideas on how I can do this?

[lostpassword]

To add Exim messsage ID field, try to add attribute by Regular expression.
In my case, message ID can be extracted by this expression:
"(?\w\w\w\w\w\w-\w\w\w\w\w\w-\w\w)"

[lostpassword]

I'm writing all this by memory, so some parts may be incorrect. By the way, I haven't yet found a way to make Splunk understand Exim logs. I'm quite interested whether it is possible. If you will be able to achieve some progress, please spend a minute and share it here - or mail me at igonin.a.arsreu.ru.

[lostpassword]

Well, I'm new too.)
I don't know whether it is right approach... But you can try this: "Data models" -> -> "Edit objects" -> "Add event" -> "" -> -> -> -> -> and here you go)
I suspect all this can be done at the indexing stage, but as far as I understood this is "bad practice".

[ipchristian]

I'm new to splunk - is there a link to explain how to add the regular expression into splunk, so it can show the message ID?

[jgreenhalgh]

Hi, where is Exim_Message_ID coming from? I've just started pointing Splunk at some exim logs and it's not one of the fields I'm seeing.

[leonrtx]

OK, so sub searches has been fixed in version 5.0.3. SPL-62457 and is working now.

[leonrtx]

ah, wrong in the post, but was correct in Splunk. sourcetype="exim-mainlog" [search sourcetype="exim-mainlog" from_address="address" OR to_address="address" | table Exim_Message_ID]

When I run the subsearch I get no results but when I inspect the search, it's build the search correctly. So when I inspect it build the search:
sourcetype="exim-mainlog ((Exim_Message_ID=####) OR (Exim_Message_ID =####))
If I copy and paste the search from the inspect page into the search box it return the correct results. So why doesn't I see any results in the sub search?

[Ayn]

Subsearches broken? That's kind of a bold statement 🙂 Subsearches are used extensively not just by the users but also in the core product - if it was broken, trust me, you would have found out long ago. Your syntax in your example is off though. You need to explicitly specify "search" at the beginning of the subsearch.