All Apps and Add-ons

IMAP Mailbox caching does not work on splunk 7+ (workaround to prevent dups)

langd
New Member

the code to keep track of what messages it has processed in splunk does not work with Splunk 7

but a simple workaround is to add a line around line 678 of get_imap_email.py (search for \Deleted and add the line outside of the if condition)

                    M.store(num, '+Flags', '(\Flagged)')

This will flag each message (the Important flag in outlook/exchange) and then you can search for UNFLAGGED in your imap.conf (or UNDELETED UNFLAGGED if you want to be a bit more careful)

As each message is processed, it will get flagged on the IMAP server, and not processed again. This will let you have two copies running on different heavy forwarders for redundancy (although there is some chance that both copies will process the same messages at the same time and duplicate them, but it's unlikely)

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...