All Apps and Add-ons

How come my TA-mailclient is not on-boarding logs into Splunk?

daniellim
Explorer

I have encountered the following problem in configuring my TA-mailclient, help would be very much appreciated regarding ExecProcessor.

The following are the debug logs when running the search:

index=_internal sourcetype=splunkd (component=ModularInputs OR component=ExecProcessor) mail.py

10-08-2018 16:39:36.562 +0800 DEBUG ExecProcessor - cmd='python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py' Not added to run queue
10-08-2018 16:39:36.562 +0800 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" ERROR
10-08-2018 16:39:36.562 +0800 DEBUG ExecProcessor - PipelineSet 0: Destroying ExecedCommandPipe for "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" id=88
10-08-2018 16:39:36.561 +0800 DEBUG ExecProcessor - PipelineSet 0: Ran script: python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py, took 0.836022 seconds to run, 0 bytes read 0 events read, exited with code 1
10-08-2018 16:39:36.551 +0800 DEBUG ExecProcessor - PipelineSet 0: Got EOF from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py", uniqueId=88
10-08-2018 16:39:35.943 +0800 INFO  ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" POP3 debug: +OK User successfully logged on.
10-08-2018 16:39:35.881 +0800 INFO  ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" POP3 debug: +OK
10-08-2018 16:39:35.878 +0800 INFO  ExecProcessor - message from "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" POP3 - Connecting to mailbox as XXXX@XXX.XXX
10-08-2018 16:39:35.725 +0800 DEBUG ExecProcessor - PipelineSet 0: Created new ExecedCommandPipe for "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py", uniqueId=88
10-08-2018 16:39:35.725 +0800 DEBUG ExecProcessor - Running: python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py on PipelineSet 0
10-08-2018 16:39:35.182 +0800 DEBUG ExecProcessor - cmd='python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py' Added to run queue
10-08-2018 16:39:35.182 +0800 DEBUG ExecProcessor - adding "python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py" to runqueue
10-08-2018 16:39:35.182 +0800 DEBUG ExecProcessor - ExecProcessorSharedState::addToRunQueue() path='python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py' restartTimerIfNeeded=1
10-08-2018 16:38:36.002 +0800 DEBUG ExecProcessor - cmd='python /opt/splunk/etc/apps/TA-mailclient/bin/mail.py' Not added to run queue

It seems the script managed to login as User, but I am unable to get the events from my mailbox.
Looking forward to any help, and also if any other info that i have missed out. Thank you.

0 Karma
1 Solution

daniellim
Explorer

I have noticed that if the email contains a corrupted attachment, the TA scripts will throw an error and any emails after that will not get onboarded.

But once that email with corrupted attachment is deleted from the inbox, the rest of the email will get onboarded.

View solution in original post

daniellim
Explorer

I have noticed that if the email contains a corrupted attachment, the TA scripts will throw an error and any emails after that will not get onboarded.

But once that email with corrupted attachment is deleted from the inbox, the rest of the email will get onboarded.

Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...