topic RSS Feeds or Email notification as Data Inputs in Getting Data In

RSS Feeds or Email notification as Data Inputs

kkumarm — Wed, 07 Nov 2012 09:08:01 GMT

Hi,

I would like to know if there is any way in which rss feeds or email notification from remote systems can be taken as data inputs in splunk ( am using a nms tool which has rss feeds and email notification)

Regards,

Mahesh

Re: RSS Feeds or Email notification as Data Inputs

dwaddle — Sun, 11 Nov 2012 15:23:38 GMT

Yes you can.

For RSS, @ndoshi has already made an add-on app for reading RSS feeds and indexing them, see http://splunk-base.splunk.com/apps/22395/rss-scripted-input

For email, there are several ways of dealing with it. One is an app by Erik Swan, http://splunk-base.splunk.com/apps/22390/splunk-for-imap. Approaches using unix maildir or procmail is documented at http://splunk-base.splunk.com/answers/61093/how-can-i-convert-mailbox-or-maildir-to-splunk?page=1&focusedAnswerId=61102#61102

Either way, the answer is yes you can do this, provided you are willing to do a little integration work yourself. Splunk does not provide this functionality "out of the box", but gives you the tools to do this for yourself in the form of scripted inputs and (new in 5.0) modular inputs.

Re: RSS Feeds or Email notification as Data Inputs

amit_saxena — Thu, 12 Sep 2013 17:24:22 GMT

Hi,

RSS can be read like a regular XML so you can use any language that has the capability of reading and extracting data from XML apart from fetching any web page.

Regards,
Amit Saxena