Is it possible to get alerts which the input is email from Imap mailbox app and the output is syslog alert?

[sarit_s]

Hello ,

Is it possible to get alerts which the input is email from Imap mailbox app and the output is syslog alert?

thanks

[martin_mueller]

Sure. Index your emails, get or write a syslog alert action, write a search for alert-worthy emails, save it as an alert using the syslog alert action.

[sarit_s]

Hello Martin,

Thanks for you answer.
Can you please explain it to me more detailed?
What is syslog alert action ?

Thanks,
Sarit

[martin_mueller]

I don't think a syslog alert action exists already, but you can write one using the new-in-6.3 modular alerting framework: http://docs.splunk.com/Documentation/Splunk/6.3.3/AdvancedDev/ModAlertsIntro