Deployment Architecture

index unix mailbox

dominiquevocat
Motivator

We have many legacy scripts that send status messages by email. We strongly prefer not to modify the scripts and instead look for a way to index the emails.

I had the idea of sending the mails also to a mailbox on a unix server, idealy the machine running a splunk indexer and have the indexer index also the unix-style mailbox file so we can search all the messages.

Is this a) possible, b) sensible and how would i do it? (I guess index the path but yeah).

Thanks

Tags (2)
1 Solution

fk319
Builder

Interesting, it can be done, but there is a bit of work.


First, you will need to Splunk to use the mailbox as a source of logs (input.config). Then you will heve to teach Splunk to parse an mbox file so that each message is a single record (props.config and transform.config), LINEBREAKER I think it is called may be of value.


Is it sensable, that is up to you, it realy is not that hard, just getting splunk to understand mbox format, which is well defiend.

View solution in original post

fk319
Builder

Interesting, it can be done, but there is a bit of work.


First, you will need to Splunk to use the mailbox as a source of logs (input.config). Then you will heve to teach Splunk to parse an mbox file so that each message is a single record (props.config and transform.config), LINEBREAKER I think it is called may be of value.


Is it sensable, that is up to you, it realy is not that hard, just getting splunk to understand mbox format, which is well defiend.

dominiquevocat
Motivator

will give it a try. i mark it as solved, thanks.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...