All Apps and Add-ons

IMAP app : getting "endid" error : Rackspace mail server

krussell101
Path Finder

Trying to get imap app to work on AWS linux splunk host using Rackspace IMAP mail server.

Have worked through a number of errors using the following.

bin/splunk cmd python etc/apps/imap/bin/getimap.py --debug

Pretty sure it is logging in correctly to imap account, since I put a bad password in and got the following error: Could not log into server: secure.emailsrvr.com with password provided.

Despite the debug output below: I also know the mailbox is not empty.

Some debug output changed to protect the innocent.

I appreciate any and all assistance.

DEBUG:root:END_IMAP_BREAKER=EndIMAPMessage

DEBUG:root:bodySourceType=imapbody

DEBUG:root:body_separator=____________________ Message Body ____________________

DEBUG:root:debug=True

DEBUG:root:deleteWhenDone=False

DEBUG:root:folders=

DEBUG:root:fullHeaders=False

DEBUG:root:headerSourceType=imap

DEBUG:root:imapSearch=(UNDELETED SMALLER 204800)

DEBUG:root:includeBody=False

DEBUG:root:mimeTypes=text/plain

DEBUG:root:noCache=False

DEBUG:root:password=wrong

DEBUG:root:port=993

DEBUG:root:server=secure.emailsrvr.com

DEBUG:root:splunkHostPath=https://localhost:8089

DEBUG:root:splunkpassword=wrong

DEBUG:root:splunkuser=admin

DEBUG:root:splunkxpassword=

DEBUG:root:timeout=10

DEBUG:root:useBodySourceType=False

DEBUG:root:useSSL=True

DEBUG:root:user=aws_alarms@somecompany.com

DEBUG:root:version=1.2

DEBUG:root:xpassword=

DEBUG:root:VERSION = 1.2

DEBUG:root:about to dump mailbox *

DEBUG:root:decrypted splunk password

DEBUG:splunk.clilib.cli_common:Preloading from '/opt/splunk/var/run/splunk/merged/server.conf'.

DEBUG:splunk.clilib.cli_common:Preloading from '/opt/splunk/var/run/splunk/merged/web.conf'.

DEBUG:splunk.rest:simpleRequest > POST https://localhost:8089/services/auth/login [[REDACTED]] sessionSource=SDK

DEBUG:splunk.rest:simpleRequest < server responded status=200 responseTime=0.0122s

DEBUG:splunk.rest:simpleRequest > POST https://localhost:8089/services/search/jobs [search=search%20index%3Dmail%20mailbox%3D%22%2A%22%20%7C%20head%201%20%7C%20stats%20max%28Date%29] sessionSource=direct

DEBUG:splunk.rest:simpleRequest < server responded status=201 responseTime=0.1383s

DEBUG:splunk.rest:simpleRequest > GET https://localhost:8089/services/search/jobs/1341228798.51 [] sessionSource=direct

DEBUG:splunk.rest:simpleRequest < server responded status=200 responseTime=0.0072s

DEBUG:splunk.search:getStatus - elapsed=0.00747990608215 nextRetry=0.0500000033479

DEBUG:splunk.search:job dispatch state not sufficient (PARSING); retrying

DEBUG:splunk.rest:simpleRequest > GET https://localhost:8089/services/search/jobs/1341228798.51 [] sessionSource=direct

DEBUG:splunk.rest:simpleRequest < server responded status=200 responseTime=0.0075s

DEBUG:splunk.search:getStatus - elapsed=0.0661470890045 nextRetry=0.0500023153796

DEBUG:splunk.search:job dispatch state not sufficient (PARSING); retrying

DEBUG:splunk.rest:simpleRequest > GET https://localhost:8089/services/search/jobs/1341228798.51 [] sessionSource=direct

DEBUG:splunk.rest:simpleRequest < server responded status=200 responseTime=0.0078s

DEBUG:splunk.search:getStatus - elapsed=0.125062942505 nextRetry=0.0500156486153

DEBUG:root:dispatched search = search index=mail mailbox="*" | head 1 | stats max(Date)

DEBUG:root:dispatched job to splunk through the REST API. Waiting for response...

DEBUG:splunk.rest:simpleRequest > GET https://localhost:8089/services/search/jobs/1341228798.51 [] sessionSource=direct

DEBUG:splunk.rest:simpleRequest < server responded status=200 responseTime=0.0070s

DEBUG:splunk.search:getStatus - elapsed=0.00722002983093 nextRetry=0.050000003011

DEBUG:root:*** waiting

DEBUG:splunk.rest:simpleRequest > GET https://localhost:8089/services/search
/jobs/1341228798.51 [] sessionSource=direct

DEBUG:splunk.rest:simpleRequest < server responded status=200 responseTime=0.0092s

DEBUG:splunk.search:getStatus - elapsed=0.00941205024719 nextRetry=0.0500000066703

DEBUG:root:

DEBUG:root: mailbox was empty

DEBUG:splunk.search:Executing action=cancel on job id=1341228798.51

DEBUG:splunk.rest:simpleRequest > POST https://localhost:8089/services/search/jobs/1341228798.51/control [action=cancel] sessionSource=direct
DEBUG:splunk.rest:simpleRequest < server responded status=200 responseTime=0.0069s

DEBUG:root:using last time of

DEBUG:root:local variable 'endid' referenced before assignment

Traceback (most recent call last):
File "etc/apps/imap/bin/getimap.py", line 415, in getMailbox
if endid < 1:
UnboundLocalError: local variable 'endid' referenced before assignment

ERROR:root:ERROR - trying to select mailgox

1 Solution

richnavis
Contributor

I ran into this same problem when not specifying the name of the folder to use... It looks to me that you are seeing the same problem.. Your Debug says the following.. DEBUG:root:folders=

I suggest changing your imap.conf files to folders = all and see if this solves it. It did for me.

View solution in original post

richnavis
Contributor

I ran into this same problem when not specifying the name of the folder to use... It looks to me that you are seeing the same problem.. Your Debug says the following.. DEBUG:root:folders=

I suggest changing your imap.conf files to folders = all and see if this solves it. It did for me.

krussell101
Path Finder

Wow. It's been so long since I posted this I have to shake off the cobwebs to recall why I needed this app. 🙂 Haven't fully validated that all is working but it's certainly getting A LOT further than it was. So THANK YOU!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...