RSS Feeds or Email notification as Data Inputs

[kkumarm]

Hi,

I would like to know if there is any way in which rss feeds or email notification from remote systems can be taken as data inputs in splunk ( am using a nms tool which has rss feeds and email notification)

Regards,

Mahesh

[amit_saxena]

Hi,

RSS can be read like a regular XML so you can use any language that has the capability of reading and extracting data from XML apart from fetching any web page.

Regards,
Amit Saxena

[dwaddle]

Yes you can.

For RSS, @ndoshi has already made an add-on app for reading RSS feeds and indexing them, see http://splunk-base.splunk.com/apps/22395/rss-scripted-input

For email, there are several ways of dealing with it. One is an app by Erik Swan, http://splunk-base.splunk.com/apps/22390/splunk-for-imap. Approaches using unix maildir or procmail is documented at http://splunk-base.splunk.com/answers/61093/how-can-i-convert-mailbox-or-maildir-to-splunk?page=1&fo...

Either way, the answer is yes you can do this, provided you are willing to do a little integration work yourself. Splunk does not provide this functionality "out of the box", but gives you the tools to do this for yourself in the form of scripted inputs and (new in 5.0) modular inputs.