All Apps and Add-ons

Does IMAP Mailbox support indexing of attachments, such as emailed CSV attachments?

jamesdaily
Explorer
 
Tags (1)
0 Karma

hgehrts_splunk
Splunk Employee
Splunk Employee

I just tested it and it is not working.
There are scripts out there that download attachments to a filesystem. I think that's the way to go as of now.

0 Karma

ragingwire
Path Finder

if you are looking at simply indexing a CSV file there are other ways to do so, and make the fields a key/value pair as well. That could not get accomplished with simply indexing an email attachment.

You could have a file directory on your splunk waiting to index any file in it, and put file there via FTP, or a custom python script.

Here is an example for importing csv files:

inputs.conf
[batch:///tmp/file.csv]
sourcetype=MINE
move_policy=sinkhole

props.conf
[MINE]
INDEXED_EXTRACTIONS=CSV
FIELD_DELIMITER=,
FIELD_QUOTE="
HEADER_FIELD_LINE_NUMBER=1

0 Karma

ragingwire
Path Finder

There is a mimeTypes you can set to index different mime types. Default is text/plain. You can play around with that. But I have no tried with csv attachments, nor know what it will look like when indexed.

0 Karma

hgehrts_splunk
Splunk Employee
Splunk Employee

Does this apply to all attachments or only to binary? I found this mime type setting... so if I send an email with a csv attached to it, will splunk be able to index the csv from that email as well if I add text/comma-separated-values to the list of mime types?

0 Karma

ragingwire
Path Finder

Splunk can only index text data. So attachments could not be indexed.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...