|
I can't wrap my head around how to accomplish this, but postfix logs two separate events for one email. The first event contains the from address: The second event contains the to address, status and other goodies: I want to build a search based on the from address, but do stats on the status (separate counts for deffered, sent, reject etc.). Anyway I could make splunk realize these two events are related? |
|
You could use the transaction command to build a transaction for these events. I don't have a great deal of experience with Postfix, is the DE82B40611 unique to these events? So something you could do to merge these into one event if that is unique to this email is; This would produce one event per all events that contain the MaybeUnique field which is the string I mentioned above in extracted form. The other option is to do something like; Which should build a transaction based on the contents of the first event matching startswith and the last event in the transaction matching endswith with a max time between events of 5seconds Brilliant and great eye! the DE82B40611 is unique to the messages! so your Works perfectly! From there i just ran it through a where and count by status, here is the full search i ended up with.
(17 Feb '12, 04:19)
Will I AM
No worries, glad its working
(17 Feb '12, 04:55)
Drainy
|