I have a system that only outputs email alerts - no logging. Is there a way to configure splunk to accept these emails and index the data? Even if it is only to read the subject line, since it has all of the information I need to make decisions. Thanks!
I am interested if anyone is doing this presently? I have a huge number of alerts being addressed over Email and need to find a solution to retain and present these.
Presently alerts are being received by send mail and processed with a perl script.
One option that comes to mind is to use the IMAP app for Splunk:
http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+IMAP
It allows you to download emails from an IMAP account and index those in Splunk.
IMAP app would be the ideal thing to install.