All Apps and Add-ons

IMAP APP doesn't index google mail

appleman
Contributor

Hello,

I'm trying to use IMAP app, but it doesn't index anything.
Following is my imap.conf, if you find any error, please let me know.


IMAPアプリをインストールし、imap.confに設定内容を記載したのですが、インデックスがされません。
設定内容は下記の通りになりますので、どこか間違いがありましたらご指摘をお願い致します。

[IMAP Configuration]
debug = False
deleteWhenDone = False
disabled = False
fullHeaders = False
includeBody = True
noCache = False
server = my server
useSSL = True
user = username
port = 993
password = xxxxxxxxx
folders = all
imapSearch = UNDELETED SMALLER 204800
splunkuser = admin
splunkpassword = changeme
splunkHostPath = http://localhost:8000

0 Karma

cwl
Contributor

Gmailで新しいアカウントを作成し、Splunk 5.0.14にSplunk for IMAP 1.20をインストールし、index=mailで検索したところ、問題なくGmailメールの内容を確認することができました。

参考用に使用したimap.confを以下の通りに共有します。

[IMAP Configuration]
server = imap.gmail.com
user = aa6743@gmail.com
xpassword =
password = xxxxxxx
useSSL = true
port = 993
fullHeaders = False
includeBody = True
mimeTypes = text/plain
folders = all
imapSearch = UNDELETED SMALLER 204800
deleteWhenDone = False
debug = False
noCache = False
splunkuser = admin
splunkpassword = a
splunkxpassword =
splunkHostPath = https://localhost:8089
timeout = 10

注意点としては、以下の2点です。

  1. IMAPを有効にする必要がある。

https://support.google.com/mail/troubleshooter/1668960?hl=ja&ref_topic=3397961&vid=1-635754175026354...

  1. メールの内容はmailインデックスに入るため、index=mailを検索する必要がある。
0 Karma

Lionel
Splunk Employee
Splunk Employee

Hello,

It is true it can be more complex to set up the IMAP app with Google.
However, you should try first by updating the the imap.conf files (usually under /splunk/etc/apps/imap/local) and adding your Google Account parameters.
For user name and get from your Google account the parameter of your server.
if this does not work.

Did you get a chance to look at this question, already?

0 Karma

prewin
New Member

Hey,
I'm testing the IMAP in a windows environment and i keep running into this error"main.LoginError: Could not log into server: imap.gmail.com with password provided". I'm using gmail here, can you please tell me in brief the steps you have done in configuring the imap mailbox.? Did you do anything in the python script apart from password encryption to make it work.?

0 Karma

appleman
Contributor

splunkのバージョンは5を利用しています。

0 Karma

melonman
Motivator

こちら、ご利用のSplunkはversion 6ですか?Appページを見たところ、サポートされるSplunkは5までということになっていますので、バージョンを確認いただければと思います。

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...