Splunk Search

getimap.py not working

bckq
Path Finder

I have problem with running getimap.py. I have configured imap.conf properly. getimap.py see that there are 191 mails in the mailbox, but I get those errors.

EndIMAPMessage
DEBUG:root:about to get all mail up to counter :191
DEBUG:root:about so imap search with : (UNDELETED SMALLER 204800 1:201)
DEBUG:root:returned from search with 191ids
DEBUG:root:id return from search : ['1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15', '16', '17', '18', '19', '20', '21', '22', '23', '24', '25', '26', '27', '28', '29', '30', '31', '32', '33', '34', '35', '36', '37', '38', '39', '40', '41', '42', '43', '44', '45', '46', '47', '48', '49', '50', '51', '52', '53', '54', '55', '56', '57', '58', '59', '60', '61', '62', '63', '64', '65', '66', '67', '68', '69', '70', '71', '72', '73', '74', '75', '76', '77', '78', '79', '80', '81', '82', '83', '84', '85', '86', '87', '88', '89', '90', '91', '92', '93', '94', '95', '96', '97', '98', '99', '100', '101', '102', '103', '104', '105', '106', '107', '108', '109', '110', '111', '112', '113', '114', '115', '116', '117', '118', '119', '120', '121', '122', '123', '124', '125', '126', '127', '128', '129', '130', '131', '132', '133', '134', '135', '136', '137', '138', '139', '140', '141', '142', '143', '144', '145', '146', '147', '148', '149', '150', '151', '152', '153', '154', '155', '156', '157', '158', '159', '160', '161', '162', '163', '164', '165', '166', '167', '168', '169', '170', '171', '172', '173', '174', '175', '176', '177', '178', '179', '180', '181', '182', '183', '184', '185', '186', '187', '188', '189', '190', '191']
DEBUG:root:1. Failed to get and print message iwth UID 1
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 1
DEBUG:root:1. Failed to get and print message iwth UID 2
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 2
DEBUG:root:1. Failed to get and print message iwth UID 3
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 3
DEBUG:root:1. Failed to get and print message iwth UID 4
Tags (3)
0 Karma
1 Solution

bckq
Path Finder

I have added some lines to the /opt/splunk/etc/apps/imap/local/imap.conf file like below, because it looked like something is missing:

[IMAP Configuration]
debug = False
deleteWhenDone = True
disabled = 0
fullHeaders = False
includeBody = True
noCache = False
useSSL = True
server = PASTE_HERE
user = PASTE_HERE
password = PASTE_HERE
port = 993
splunkuser = PASTE_HERE
splunkpassword = PASTE_HERE
folders = Inbox
splunkHostPath = https://localhost:8089

View solution in original post

0 Karma

bckq
Path Finder

I have added some lines to the /opt/splunk/etc/apps/imap/local/imap.conf file like below, because it looked like something is missing:

[IMAP Configuration]
debug = False
deleteWhenDone = True
disabled = 0
fullHeaders = False
includeBody = True
noCache = False
useSSL = True
server = PASTE_HERE
user = PASTE_HERE
password = PASTE_HERE
port = 993
splunkuser = PASTE_HERE
splunkpassword = PASTE_HERE
folders = Inbox
splunkHostPath = https://localhost:8089
0 Karma

telrock
Engager

What was the answer? I have the same problem

0 Karma

mookiie2005
Communicator

@telrock did you ever solve this problem? We are having teh same issue and I tried to amend the python script with your suggestion, however, it did not resolve the issue.

0 Karma

rmedinas
Engager

Thanks, this solved my problem.

0 Karma

telrock
Engager

line 651 of /opt/splunk/etc/apps/imap/bin/getimap.py
change
cstr.write("ContentType : ", part.get_content_type() + '\n')
into
cstr.write("ContentType : "+ part.get_content_type() + '\n')

bckq
Path Finder

Problem solved.

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...