Splunk Search

getimap.py not working

bckq
Path Finder

I have problem with running getimap.py. I have configured imap.conf properly. getimap.py see that there are 191 mails in the mailbox, but I get those errors.

EndIMAPMessage
DEBUG:root:about to get all mail up to counter :191
DEBUG:root:about so imap search with : (UNDELETED SMALLER 204800 1:201)
DEBUG:root:returned from search with 191ids
DEBUG:root:id return from search : ['1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15', '16', '17', '18', '19', '20', '21', '22', '23', '24', '25', '26', '27', '28', '29', '30', '31', '32', '33', '34', '35', '36', '37', '38', '39', '40', '41', '42', '43', '44', '45', '46', '47', '48', '49', '50', '51', '52', '53', '54', '55', '56', '57', '58', '59', '60', '61', '62', '63', '64', '65', '66', '67', '68', '69', '70', '71', '72', '73', '74', '75', '76', '77', '78', '79', '80', '81', '82', '83', '84', '85', '86', '87', '88', '89', '90', '91', '92', '93', '94', '95', '96', '97', '98', '99', '100', '101', '102', '103', '104', '105', '106', '107', '108', '109', '110', '111', '112', '113', '114', '115', '116', '117', '118', '119', '120', '121', '122', '123', '124', '125', '126', '127', '128', '129', '130', '131', '132', '133', '134', '135', '136', '137', '138', '139', '140', '141', '142', '143', '144', '145', '146', '147', '148', '149', '150', '151', '152', '153', '154', '155', '156', '157', '158', '159', '160', '161', '162', '163', '164', '165', '166', '167', '168', '169', '170', '171', '172', '173', '174', '175', '176', '177', '178', '179', '180', '181', '182', '183', '184', '185', '186', '187', '188', '189', '190', '191']
DEBUG:root:1. Failed to get and print message iwth UID 1
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 1
DEBUG:root:1. Failed to get and print message iwth UID 2
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 2
DEBUG:root:1. Failed to get and print message iwth UID 3
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 3
DEBUG:root:1. Failed to get and print message iwth UID 4
Tags (3)
0 Karma
1 Solution

bckq
Path Finder

I have added some lines to the /opt/splunk/etc/apps/imap/local/imap.conf file like below, because it looked like something is missing:

[IMAP Configuration]
debug = False
deleteWhenDone = True
disabled = 0
fullHeaders = False
includeBody = True
noCache = False
useSSL = True
server = PASTE_HERE
user = PASTE_HERE
password = PASTE_HERE
port = 993
splunkuser = PASTE_HERE
splunkpassword = PASTE_HERE
folders = Inbox
splunkHostPath = https://localhost:8089

View solution in original post

0 Karma

bckq
Path Finder

I have added some lines to the /opt/splunk/etc/apps/imap/local/imap.conf file like below, because it looked like something is missing:

[IMAP Configuration]
debug = False
deleteWhenDone = True
disabled = 0
fullHeaders = False
includeBody = True
noCache = False
useSSL = True
server = PASTE_HERE
user = PASTE_HERE
password = PASTE_HERE
port = 993
splunkuser = PASTE_HERE
splunkpassword = PASTE_HERE
folders = Inbox
splunkHostPath = https://localhost:8089
0 Karma

telrock
Engager

What was the answer? I have the same problem

0 Karma

mookiie2005
Communicator

@telrock did you ever solve this problem? We are having teh same issue and I tried to amend the python script with your suggestion, however, it did not resolve the issue.

0 Karma

rmedinas
Engager

Thanks, this solved my problem.

0 Karma

telrock
Engager

line 651 of /opt/splunk/etc/apps/imap/bin/getimap.py
change
cstr.write("ContentType : ", part.get_content_type() + '\n')
into
cstr.write("ContentType : "+ part.get_content_type() + '\n')

bckq
Path Finder

Problem solved.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...