Getting splunk to accept email alerts from other systems

[flytbonesteak]

I have a system that only outputs email alerts - no logging. Is there a way to configure splunk to accept these emails and index the data? Even if it is only to read the subject line, since it has all of the information I need to make decisions. Thanks!

[bigtyma]

I am interested if anyone is doing this presently? I have a huge number of alerts being addressed over Email and need to find a solution to retain and present these.

Presently alerts are being received by send mail and processed with a perl script.

[ziegfried]

One option that comes to mind is to use the IMAP app for Splunk:

http://splunkbase.splunk.com/apps/All/4.x/app:Splunk+for+IMAP

It allows you to download emails from an IMAP account and index those in Splunk.

[Simeon]

IMAP app would be the ideal thing to install.