Getting Data In

Monitoring logs sent by email to splunk

royimad
Builder

Hello Splunkies,

I was wondering if splunk could monitor a logs sent by email to splunk server. if yes how this could be done?

0 Karma

bbiandov
Path Finder

Just a follow up to see whether the inbound SMTP feature may be part of the arsenal now? Or alternatively a splunk triggered checking of a mailbox? Say IMAP or whatever and then extracting the content for indexing?

Sure simple SMTP hack isn't that big of a deal but I am hoping someone has already done it if not already integrated into the latest version of enterprise?

0 Karma

Ayn
Legend

Splunk in itself has no SMTP server and so cannot out of the box receive emails. However thanks to scripted inputs you can do all kinds of weird (and wonderful!) things to get data into Splunk. Simply put, set up some kind of solution for

  1. Receiving emails (use your SMTP server of choice...postfix, sendmail...)
  2. Extracting the contents of these emails (some kind of script)

Once you have that in place, Splunk can run the script as a scripted input and consume the script's output, thus getting the data from the emails into Splunk.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...