Reporting

maildir indexing?

jtrucks
Splunk Employee
Splunk Employee

Has anyone indexed maildir formatted email archives/folders before? I'm thinking this might be crazy but useful to ingest my archived mail, which is all on local disk on the system running Splunk.

Thoughts? Ideas?

Tags (3)
1 Solution

jtrucks
Splunk Employee
Splunk Employee

Turns out that Splunk will read Maildir trees just fine. With some transform magic you can get all the fields to work, as well.

View solution in original post

0 Karma

jtrucks
Splunk Employee
Splunk Employee

Turns out that Splunk will read Maildir trees just fine. With some transform magic you can get all the fields to work, as well.

View solution in original post

0 Karma

eashwar
Communicator

hi jtrucks

is this what you are looking for

http://blogs.splunk.com/2011/01/07/splunk-sysadmin-email/

0 Karma

jtrucks
Splunk Employee
Splunk Employee

I don't know what the tacotacotaco stuff is for, but perhaps I could point Splunk just at the maildir and see what happens...

0 Karma

jtrucks
Splunk Employee
Splunk Employee

So, this is similar, but not quite it as I am thinking of full mail parsing for random email:

http://splunk-base.splunk.com/answers/61093/how-can-i-convert-mailbox-or-maildir-to-splunk

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!