receive emails from thirdpart app as event in splunk

[pouriajalilian1]

i have a server that the only way it can alert on events is to send emails to an external thirdparty app ,like splunk.so i want to monitor whenever it receives emails and create alerts,dashboards based on that events.is it possible??please give me clear advice on that .

[richgalloway]

Splunk cannot receive email directly. It can, however, access IMAP mailboxes using the IMAP Mailbox app (https://splunkbase.splunk.com/app/1739/). I once wrote a scripted input to access Office 365 mailboxes using an API that is no longer supported. So there are options. Post specific questions and we may be able to help more.

[pouriajalilian1]

[IMAP Configuration]
debug = 0
deleteWhenDone = 0
disabled = 0
fullHeaders = 1
includeBody = 1
noCache = 0
port = 587
server = mail.test.com
useSSL = 1
user =username@test.com
password =**********
mimeTypes = text/plain
folders = all
imapSearch = UNDELETED
deleteWhenDone = False
noCache = False
splunkuser = admin
splunkpassword =*****
timeout = 10
---------i wrote something like this,but it didnt work.
besides,i enabled windows script on inputs.conf and disabled nix one as instructed in the manual .help me please

[richgalloway]

I don't know enough about the IMAP app to offer detailed help. You may want to post a new question.

[pouriajalilian1]

thank you my friend

[pouriajalilian1]

does Streams events from from a mail server. is what i have to configure?? in this way,i couldnt set protocol filed .