All Apps and Add-ons

Splunk for IMAP stop indexing data

New Member

We installed and configured splunk for imap.
it worked and indexed data but from some reason it stopped indexing data after a few hours.


  • verified that the mailbox contains new messages
  • verified that the mailbox was not full.
  • when I ran "/opt/splunk/bin/splunk cmd python /splunk/etc/apps/imap/bin/ --debug" it connected to the mailbox but from some reason did not find any new messages.
  • I've deleted some of the old messages and change imap.conf filtering to: imapSearch = UNDELETED instead of "imapSearch = UNDELETED SMALLER 204800"
  • After the changes splunk index the new messages

I've enabled debug in imap.conf but not sure what value it adds..

I want to know why it stopped and verify it won't happen again.

Where are the imap app log files located?
How can I troubleshoot it further?

0 Karma

Re: Splunk for IMAP stop indexing data


Bump. I have a similar issue and the same questions.

If I run via the commandline (as James did above) and pump the output to a log file the log file will get the IMAP entries for the mail in the folder, but the mail index in splunk never gets any data


Re: Splunk for IMAP stop indexing data

Path Finder

You can always search the splunk internal index for errors for the script.

index=_internal imap source="*splunkd.log"

See what you may find.

Also you can " tail -f var/log/splunk/python.log" file too.

I also noticed that if you don't delete your email after indexing "deleteWhenDone = True" in imap.conf, then the python script can take a looooong time to find the next set of emails to index. I noticed the script back logged for 2 hours on my install. I had to purge my mail box and then enable the delete option and things were ok again.