All Apps and Add-ons

IMAP Mailbox caching does not work on splunk 7+ (workaround to prevent dups)

langd
New Member

the code to keep track of what messages it has processed in splunk does not work with Splunk 7

but a simple workaround is to add a line around line 678 of get_imap_email.py (search for \Deleted and add the line outside of the if condition)

                    M.store(num, '+Flags', '(\Flagged)')

This will flag each message (the Important flag in outlook/exchange) and then you can search for UNFLAGGED in your imap.conf (or UNDELETED UNFLAGGED if you want to be a bit more careful)

As each message is processed, it will get flagged on the IMAP server, and not processed again. This will let you have two copies running on different heavy forwarders for redundancy (although there is some chance that both copies will process the same messages at the same time and duplicate them, but it's unlikely)

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...