All Apps and Add-ons

IMAP Mailbox caching does not work on splunk 7+ (workaround to prevent dups)

langd
New Member

the code to keep track of what messages it has processed in splunk does not work with Splunk 7

but a simple workaround is to add a line around line 678 of get_imap_email.py (search for \Deleted and add the line outside of the if condition)

                    M.store(num, '+Flags', '(\Flagged)')

This will flag each message (the Important flag in outlook/exchange) and then you can search for UNFLAGGED in your imap.conf (or UNDELETED UNFLAGGED if you want to be a bit more careful)

As each message is processed, it will get flagged on the IMAP server, and not processed again. This will let you have two copies running on different heavy forwarders for redundancy (although there is some chance that both copies will process the same messages at the same time and duplicate them, but it's unlikely)

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...