https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47934#M978 <P>If what you are after is a general idea of whether you can index and search larger blocks of text like e-mails, then yes. I have a few hundred thousand emails indexed. But I do it a little differently. I store the data in a database and use a scripted input to format the content in a way that makes it easy to create fields in transforms.conf</P> <P>edit: I would add, like the commenter above, it's probably not the best tool for this kind of job though.</P> Sat, 17 Aug 2013 22:16:35 GMT jpass 2013-08-17T22:16:35Z https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47931#M975 <P>Can emails be sent directly to a Splunk server so it can go through and alert on emails of interest? </P> Tue, 28 May 2013 20:13:07 GMT https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47931#M975 marykyeung 2013-05-28T20:13:07Z https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47932#M976 <P>You can't send it directly to splunk but I guess you could send it to an account on a server and index the mbox file on the server.</P> <P>However, I am not sure this is the best technology fit. Usually people use Splunk to monitor everything at the mail server rather than sending messages directly to it to index.</P> Wed, 29 May 2013 02:06:06 GMT https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47932#M976 okrabbe_splunk 2013-05-29T02:06:06Z https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47933#M977 <P>There are people who have indexed maildir directory trees or individual files using Splunk. Because there are datestamps in the file, it's not too bad at figuring out the timestamp. However, you might have to futz with the header fields to make subject et al. searchable.</P> <P>Search Splunk-Base for "maildir" to find more examples.</P> Thu, 13 Jun 2013 20:29:44 GMT https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47933#M977 jtrucks 2013-06-13T20:29:44Z https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47934#M978 <P>If what you are after is a general idea of whether you can index and search larger blocks of text like e-mails, then yes. I have a few hundred thousand emails indexed. But I do it a little differently. I store the data in a database and use a scripted input to format the content in a way that makes it easy to create fields in transforms.conf</P> <P>edit: I would add, like the commenter above, it's probably not the best tool for this kind of job though.</P> Sat, 17 Aug 2013 22:16:35 GMT https://community.splunk.com/t5/Reporting/Can-Splunk-be-used-to-sort-through-emails/m-p/47934#M978 jpass 2013-08-17T22:16:35Z