Email data/content to Splunk index?

[the_wolverine]

Has someone come up with a way to send an email that would inject the contents of the email into Splunk?

[sideview · Accepted solution]

You can set up the imap app, aka 'mail' app, and then email anything you like to the email account that it's periodically indexing.

n

[gkanapathy · Accepted solution]

Yes. The IMAP application would do that. If you set up an IMAP server to receive messages, and use the Splunk for IMAP scripted input/app to fetch the messages from there.

In principle, a similar application could be made for a POP mail server. It's probably best to use something like this that leverages an existing mail infrastructure and server so as to avoid having to maintain your own.

[royimad]

Hello, I'm facing exactly the same situation.
Any idea how to use IMAP, the needed steps ?

[sideview · Accepted solution]

You can set up the imap app, aka 'mail' app, and then email anything you like to the email account that it's periodically indexing.

n