I have upgraded my home system to 6.5.0 and so far it seems to be fine. ... View more

Public GIt location is: https://github.com/IMAPMailbox/IMAPmailbox ... View more

Actually this is a good idea. I have kinda kicked around the idea before, but was not sure if any interest would be out there. I assume everyone prefers git. So I can open a git location. I'll look at it later and then post here. ... View more

I believe this was brought up in question: https://answers.splunk.com/answers/222827/does-imap-mailbox-support-indexing-of-attachments.html ... View more

You just asked a whole bunch of questions. I don't know if I can really answer them. If you are using a deployment server, you need to be careful with search heads and indexers depending if you used a cluster or not. You could also look at using the deployer method. My instructions below can be done manually, you will need to decide for your self. You can pick any index you want, just make sure the index is consistent with your UAT or prod across all systems. Install instructions are in the TA Install this TA on all Forwarder(s) or Indexer(s) in the SPLUNK/etc/apps/ directory. Install the App on your Search head(s). Disable the input script. Make sure that "disabled = true" for all of the inputs in the App under default/inputs.conf. Enable inputs on ONE of your TAs. Pick just one of the TA installs to be the collection point. Copy defaults/imap.conf to local/imap.conf Edit local/imap.conf with your correct server and user settings. Copy defaults/inputs.conf to local/inputs.conf Edit the inputs.conf file and enable the Unix or Windows script input. Set "disabled=false" to the script input to enable. Restart splunk on all systems to make sure settings take affect. ... View more

You are right if the TAs are on the same box as another IMAP TA or main app the files would conflict. If you only have one box you would need to rename everything. The TA was meant to be installed in a distributed design. So if you had other forwarders you could put one on each per mail account. Then you are not renaming everything. ... View more

Just to be more clear. The app itself can only call one IMAP account to login and index email. But since this app supports a distributed design, ie, it has a TA you can deploy. There is no reason you could not deploy multiple TAs each configured for a different IMAP mail account. You can find the TA in the main IMAP Mailbox app directory IMAPmailbox/appserver/addons/IMAPmailbox-TA/ Copy this directory to the main apps directory /opt/splunk/etc/apps/... Make multiple copies of the TA for each of your accounts. Then in each TA directory create a local/imap.conf file for each of your email accounts. You are welcome to change their indexes too or other attributes if you wish. Restart Splunk and check to see if their are indexing. thanks ... View more

See: https://answers.splunk.com/answers/168555/splunk-app-imap-mailbox.html ... View more

See: https://answers.splunk.com/answers/168555/splunk-app-imap-mailbox.html ... View more

I have upgraded my system to 6.3.0. I use SSL IMAP to gmail and am getting no errors. Is the server you are connecting too have a self-signed cert? Is it running SSL v1 or v2 or TLS? Appears there is a python ssl bug. https://stackoverflow.com/questions/14102416/python-requests-requests-exceptions-sslerror-errno-8-ssl-c504-eof-occurred Since I can't reproduce, I'm not sure if the suggested fixes will help. ... View more

no changes to the script needed. You should NOT run the script on your search head. It should be disabled there. You should run it from an indexer or forwarder if possible. There are instructions in the addon directory. ... View more

User, for gmail at least, is normally just your email address itself. That is what I use for my username. I'm glad it worked. ... View more

Comparing your output with my own when I do a debug I noticed yours has (') around your server and user values. I am not sure if that is a Windows thing or not. Did you put single quotes around those fields in your local/imap.conf file? If so try removing them. The python script may not like it and thus cannot look up the server host and thus "getaddrinfo failed" message. Here is my local/imap.conf file as an example: [IMAP Configuration] debug = 0 deleteWhenDone = 1 disabled = 0 fullHeaders = 0 includeBody = 1 folders = INBOX noCache = 0 server = imap.gmail.com useSSL = 1 user = emailme@gmail.com xpassword=somecrazyencryptionpasswordhere! ... View more

Run the script in debug mode to see what settings are being used and if there are any other errors. post that here if you could. ... View more

Are you using the correct IMAP port to connect to gmail with? Or did you set a different one in your config file? ... View more

if you are looking at simply indexing a CSV file there are other ways to do so, and make the fields a key/value pair as well. That could not get accomplished with simply indexing an email attachment. You could have a file directory on your splunk waiting to index any file in it, and put file there via FTP, or a custom python script. Here is an example for importing csv files: inputs.conf [batch:///tmp/file.csv] sourcetype=MINE move_policy=sinkhole props.conf [MINE] INDEXED_EXTRACTIONS=CSV FIELD_DELIMITER=, FIELD_QUOTE=" HEADER_FIELD_LINE_NUMBER=1 ... View more

There is a mimeTypes you can set to index different mime types. Default is text/plain. You can play around with that. But I have no tried with csv attachments, nor know what it will look like when indexed. ... View more

I had another person email me about this. but they were able to resolve it on their end. They did not tell me what fixed it. ... View more

Make sure the script is enabled to run automatically Look in local/imap.conf [IMAP Configuration] disabled = 0 Restart Splunk if you made any changes. Or restart splunk just incase to see if that will trigger it to start. You should see a log in index=_internal for the imap script if it is set to run. ... View more

Splunk can only index text data. So attachments could not be indexed. ... View more

I was looking for the same thing. I also found this: http://answers.splunk.com/answers/69438/retrieve-configuration-items-from-a-custom-python-search-command.html ... View more

I totally understand that. It is just sad that such a great app has not been updated to keep up with splunk versions. At some point running a v5 forwarder will not work with splunk indexer etc... It seems the developers do not have this on their road map. I believe they originally did, but it's been pushed aside. thanks, ... View more