I created a HEC token call test_app initially for accepting log data from a test app.  That app has morphed into a prod app.  I would like to change the HEC token name to prod_app.  How do I do that?  Thanks. ... View more

In the imap.conf, I have the following settings: includeBody = True mimeTypes = text/plain,text/html,text/richtext The email at the end of the post got parsed into: ____________________ Message Body ____________________ \x86٥\x85杙\xEBZ\x86\xDBiz\xAB\xA2\xBC*'\xB5\xE9\xEDO*^r\x89\xEDz{ I am wondering if this app supports text/html with embedded image. I don't care for the embedded image. I just want the HTML part to be parsed correctly. Did anyone ever got such an email parsed? Thanks! --===============6997838214491873743== Content-Type: multipart/mixed; boundary="===============7599000962708499449==" MIME-Version: 1.0 --===============7599000962708499449== Content-Type: text/html; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit ****** start html code which include: ************* " ****** end html code *************** --===============7599000962708499449==-- --===============6997838214491873743== Content-Type: multipart/alternative; boundary="===============7242997756288481084==" MIME-Version: 1.0 --===============7242997756288481084== Content-Type: image/jpeg MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Id: ******* encoded image ******* --===============7242997756288481084==-- --===============6997838214491873743==-- ... View more

I am trying to index a mailbox on Dovecot IMAP server, but running into some SSL errors. I am able to connect to it from a mail client through port 143, using "STARTTLS". But I am not sure what to use for "useSSL" value in the imap.conf file. When I set "useSSL=true", I got the following error: File "/opt/splunk/lib/python2.7/ssl.py", line 808, in do_handshake self._sslobj.do_handshake() SSLError: [SSL: UNKNOWN_PROTOCOL] unknown protocol (_ssl.c:603) None When I set "useSSL=false", I got: DEBUG:root:[PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. Traceback (most recent call last): File "bin/get_imap_email.py", line 340, in getMail M.login(self.user, self.password) File "/opt/splunk/lib/python2.7/imaplib.py", line 520, in login raise self.error(dat[-1]) error: [PRIVACYREQUIRED] Plaintext authentication disallowed on non-secure (SSL/TLS) connections. None Does this app support STARTTLS? Thanks. ... View more

I see in the db of one of my indexers: drwx--x--- 3 root root 4096 Aug 25 22:29 db_1503779100_1503700882_4044 drwx--x--- 3 root root 4096 Aug 26 05:05 db_1503802800_1503721750_4045 drwx--x--- 3 root root 4096 Aug 26 11:41 db_1503826800_1503745500_4046 drwx--x--- 3 root root 4096 Aug 26 18:15 db_1503850200_1503769261_4047 ...... In the colddb: ...... drwx--x--- 3 root root 4096 Aug 25 00:07 db_1503698700_1503621671_4040 drwx--x--- 3 root root 4096 Aug 25 06:06 db_1503720300_1503641264_4041 drwx--x--- 3 root root 4096 Aug 25 11:35 db_1503739860_1503662781_4042 drwx--x--- 3 root root 4096 Aug 25 16:41 db_1503758400_1503682500_4043 drwx--x--- 3 root root 4096 Sep 11 13:56 db_1490323691_1486237836_3906 drwx--x--- 3 root root 4096 Sep 11 14:44 db_1490325851_1490323116_4115 drwx--x--- 3 root root 4096 Sep 11 15:52 db_1490330171_1490325850_4117 drwx--x--- 3 root root 4096 Sep 21 17:49 db_1491201351_1490329944_4119 drwx--x--- 3 root root 4096 Nov 9 09:13 db_1495411094_1491201516_4154 What can cause the rotation from warm bucket to cold bucket to have a big gap (Sep. 21 - Nov. 9) and the bucket rolling date and bucket number out of order. Before db_1490323691_1486237836_3906, when listing by timestamp, all bucket numbers are in sequence. Should I be concerned? Thanks. ... View more