Did you configure the inputs.config file? There is a difference with how *nix servers parse file paths and windows and that file needs to be configured. Something like this would be very cool to have in the GUI as a checkbox. I missed this when setting up the 1st time. Below we define to script stanza exactly the same but with different path seperators. This allows us to work on either windows or *nix. Enable the input you need based on your OS: on = "disabled = false" off = "disabled = true" Default email check is 5 minutes, or 300 seconds. Adjust as you wish. *nix systems [script://./bin/get_imap_email.py] interval = 300 sourcetype = imap source = imap index = mail disabled = true windows [script://.\bin\get_imap_email.py] interval = 60 sourcetype = imap source = imap index = mail disabled = false ... View more

Try changing the search to return emails larger than 1 k. The following worked for me. In the IMAP config file, I changed the search to: imapSearch = UNDELETED LARGER 1 The theory is that email size is being combined with multiple emails. When there are a lot of emails, the size is larger than 300k (which is the default) and the emails are skipped and then deleted. ... View more

Brilliant laserval! That did it. Thank you! I went to splunk / etc / system / local opened the authorize config file and added capability::delete_by_keyword to the user there. Ran the search and piped into delete and the records are not showing up in searches! Can you post your answer under my original problem so I can mark it as answered? Thank you. ... View more

Then maybe they should change their documentation to say: Users not allowed to delete using Splunk free. ... View more

I am running the free version and do not have access to make any user changes. ... View more

In previous versions, I had to make sure my user account had delete privileges. In the free version, there is no user control. ... View more

Here is what I'm trying to do: Piping a search to the delete operator marks all the events returned by that search so that later searches do not return them. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Delete ... View more

Doesn't that delete all data in an index? I want to keep my data, just want to delete specific events. ... View more

Is this still true for Splunk 6.2.2 Free version? I'm trying to delete records and am unable to. ... View more

Is this true with the latest version? 6.2? I'm not able to pipe a search into the delete. It says it's deleted but if I refresh the search the data is still there. I can't check the user roles in the free version to see if I have delete access? ... View more

Have you tried turning on full headers in the config file? ... View more

Here are some of the changes I've done to get it to work: double check the linux input is enabled in the inputs config file. In the inputs config file, change the interval to a longer time than 5 min. I've set ours to 900 (15 min) Turn caching off and have it delete mail after getting. You may not be able to do this, but it works almost all the time when I've told it to delete. I believe this is what has gotten it to work for me more than anything else. If most of your emails are rich text, try adding text/rtf to the mime types. change the rest timeout to 60 seconds ... View more

This app is going to be great! We have so many automated reports that are sent through email. I'll be able to create all kinds of graphs and reporting. ... View more

So it is. My apologies. Just glossed over that step. ... View more

Working beautifully now! Thank you for this app! We send all kinds of errors using email to other servers. This will give me some reporting on the errors. ... View more

I'm not sure where the inputName is to be changed then. I'm using the Data Input - Files & Directories method to pull data off a network shared folder. Is the input name the path to the data? So I would need to change the log location? ... View more

I'd love to just delete the entry from the fishbucket. However, how do I find out the file name to delete? There is other valid data in the fishbucket that I don't want to get rid of. Also, this data source is a directory with 1 file per entry. I want to re-index the directory. ... View more

I had tried earlier to delete the input, then re-create it, however I used the same host name. After reading your post, I deleted the input, then re-created it with a different host name. The data isn't being re-indexed. Do I need to create a new sourceType? ... View more

Good to know and makes sense. I'll keep that in mind. ... View more

I found capability that needs to be assigned with the role. rest_properties_get. Make sure that is added to the role. ... View more

Make sure you have rest_properties_get in your role capabilities. ... View more

If you didn't assign that new role to your admin user, you can try resetting your Web browser, then logging in as admin. ... View more