Is there a way to ingest an entire file as an event?

[danielbb]

We have a case in which each email message is stored on the file system as a distinct file. Is there a way to ingest each file as a distinct Splunk event?

I assume that UF is the right way but I might be wrong. 

[isoutamo]

Basically you could do it. Just define needed event breaker etc so that Splunk thinks it’s only one event. Just test those in your dev env first. But you should think your needs first and especially in EU and probably in some other areas there are legislation which set lots of restrictions which you must fulfill before you could do it!