Splunk Search

getimap.py not working

bckq
Path Finder

I have problem with running getimap.py. I have configured imap.conf properly. getimap.py see that there are 191 mails in the mailbox, but I get those errors.

EndIMAPMessage
DEBUG:root:about to get all mail up to counter :191
DEBUG:root:about so imap search with : (UNDELETED SMALLER 204800 1:201)
DEBUG:root:returned from search with 191ids
DEBUG:root:id return from search : ['1', '2', '3', '4', '5', '6', '7', '8', '9', '10', '11', '12', '13', '14', '15', '16', '17', '18', '19', '20', '21', '22', '23', '24', '25', '26', '27', '28', '29', '30', '31', '32', '33', '34', '35', '36', '37', '38', '39', '40', '41', '42', '43', '44', '45', '46', '47', '48', '49', '50', '51', '52', '53', '54', '55', '56', '57', '58', '59', '60', '61', '62', '63', '64', '65', '66', '67', '68', '69', '70', '71', '72', '73', '74', '75', '76', '77', '78', '79', '80', '81', '82', '83', '84', '85', '86', '87', '88', '89', '90', '91', '92', '93', '94', '95', '96', '97', '98', '99', '100', '101', '102', '103', '104', '105', '106', '107', '108', '109', '110', '111', '112', '113', '114', '115', '116', '117', '118', '119', '120', '121', '122', '123', '124', '125', '126', '127', '128', '129', '130', '131', '132', '133', '134', '135', '136', '137', '138', '139', '140', '141', '142', '143', '144', '145', '146', '147', '148', '149', '150', '151', '152', '153', '154', '155', '156', '157', '158', '159', '160', '161', '162', '163', '164', '165', '166', '167', '168', '169', '170', '171', '172', '173', '174', '175', '176', '177', '178', '179', '180', '181', '182', '183', '184', '185', '186', '187', '188', '189', '190', '191']
DEBUG:root:1. Failed to get and print message iwth UID 1
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 1
DEBUG:root:1. Failed to get and print message iwth UID 2
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 2
DEBUG:root:1. Failed to get and print message iwth UID 3
DEBUG:root:write() takes exactly 1 argument (2 given)
Traceback (most recent call last):
  File "getimap.py", line 651, in fetchMessage
    cstr.write("ContentType :   ", part.get_content_type() + '\n')
TypeError: write() takes exactly 1 argument (2 given)
None
DEBUG:root:2. Failed to get and print message iwth UID 3
DEBUG:root:1. Failed to get and print message iwth UID 4
Tags (3)
0 Karma
1 Solution

bckq
Path Finder

I have added some lines to the /opt/splunk/etc/apps/imap/local/imap.conf file like below, because it looked like something is missing:

[IMAP Configuration]
debug = False
deleteWhenDone = True
disabled = 0
fullHeaders = False
includeBody = True
noCache = False
useSSL = True
server = PASTE_HERE
user = PASTE_HERE
password = PASTE_HERE
port = 993
splunkuser = PASTE_HERE
splunkpassword = PASTE_HERE
folders = Inbox
splunkHostPath = https://localhost:8089

View solution in original post

0 Karma

bckq
Path Finder

I have added some lines to the /opt/splunk/etc/apps/imap/local/imap.conf file like below, because it looked like something is missing:

[IMAP Configuration]
debug = False
deleteWhenDone = True
disabled = 0
fullHeaders = False
includeBody = True
noCache = False
useSSL = True
server = PASTE_HERE
user = PASTE_HERE
password = PASTE_HERE
port = 993
splunkuser = PASTE_HERE
splunkpassword = PASTE_HERE
folders = Inbox
splunkHostPath = https://localhost:8089
0 Karma

telrock
Engager

What was the answer? I have the same problem

0 Karma

mookiie2005
Communicator

@telrock did you ever solve this problem? We are having teh same issue and I tried to amend the python script with your suggestion, however, it did not resolve the issue.

0 Karma

rmedinas
Engager

Thanks, this solved my problem.

0 Karma

telrock
Engager

line 651 of /opt/splunk/etc/apps/imap/bin/getimap.py
change
cstr.write("ContentType : ", part.get_content_type() + '\n')
into
cstr.write("ContentType : "+ part.get_content_type() + '\n')

bckq
Path Finder

Problem solved.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...