Error installing IMAP App

Replies to This Discussion

Permalink Reply by Patrick Swackhammer on March 11, 2010 at 4:01am

We're running version 4.0.9, build 74233. Here's the contents of imap.conf:

#

1.Splunk IMAP Bundle
2.IMAP connection and indexing configuration
#

1.This file provides configures how the Splunk IMAP application connects to
2.the IMAP server, what email it downloads and how it gets indexed.
#

[IMAP Configuration]

1.===================================
2.Required Settings
3.===================================
#

1.server
#

1.The host name or IP address of the IMAP server that will provide the
2.mail to be indexed.
#
server = YOUR_SERVER_HERE

#

1.user
#

1.Username on the IMAP server
#
user = YOUR_USER_NAME_HERE

#

1.xpassword
#

1.User's password for the IMAP server in encrypted text.
#

1.To get an encrypted version of you password, run the genpassword.sh script
2.in this bundle's bin directory. Copy and paste its output as the value
3.below.
#
xpassword =

#

1.password
#

1.User's password for the IMAP server in plaintext.
#

1.WARNING: placing plaintext passwords in a configuration file is a significant
2.security risk. It is recommended that you leave this setting blank and
3.instead use the xpassword setting above.
#
password =

1.===================================
2.Optional Settings
3.===================================
#

1.useSSL
#

1.If True will use SSL for connection. Make sure port setting below is set correctly
#
useSSL = true

#

1.port
#

1.IMAP server port. You only need to change this if your server is running
2.on a non-standard port.
#
port = 993

#

1.fullHeaders
#

1.If True, all headers will be indexed. If False, only to, from, subject,
2.date, size, mbox, and cc will be indexed. Setting this to true will
3.increase the size of the splunk database.
#
fullHeaders = False

#

1.includeBody
#

1.If True, each message body will be indexed. In the case of multipart
2.messages, indexing will occur on all parts whose content type is in the
3.mimeTypes list (see below). If you don't need to search message bodies
4.in Splunk, setting this to False can reduce database size and increase
5.performance.
#
includeBody = True

#

1.mimeTypes
#

1.Comma-separated list mime types to be indexed. When a multipart
2.message is encountered, only parts of a type found in this list
3.will be indexed.
#

1.This settings has no effect if includeBody is False.
#
mimeTypes = text/plain

#

1.folders
#

1.A comma-separated list of folders to be indexed, e.g.
#

1.INBOX.bugs, INBOX.support, INBOX.checkins
#

1.If you wish to index everything, set this value to "all". If folder is
2.blank, then the default (typically 'INBOX') will be used.
#
folders = all

#

1.imapSearch
#

1.Provides an IMAP4 search expression that is used to query
2.for messages to be retrieved from the IMAP server for indexing.
#

1.The default imapSearch will find all undeleted messages on the server
2.which are smaller than 200k. You can modify this value to further
3.narrow the set of messages that will be retrieved.
#

1.For example, the following imapSearch will retrieve all undeleted
2.messages smaller than 200k that were sent by erik@splunk.com since
3.Feburary 1997:
#

1.UNDELETED SMALLER 204800 FROM "erik@splunk.com" SINCE 1-Feb-1997
#

1.As another example, the following imapSearch will retrieve
2.all undeleted messages with the word 'chocolate' in the body and the word
3.'cake' or 'ice cream' in the subject:
#

1.UNDELETED BODY "chocolate" (OR SUBJECT "cake" SUBJECT "ice cream")
#
#

1.A complete description of search strings can be found in section 6.4.4
2.of the IMAP specification:
#

1.http://www.isi.edu/in-notes/rfc3501.txt
#
imapSearch = UNDELETED SMALLER 204800

#

1.deleteWhenDone
#

1.If true will delete messages from mailbox after indexing.
2.Should note that deteleWhenDone overrides any caching and assumes that each time
3.the script gets called all messages in the inbox are new.
#
deleteWhenDone = False

1.
2.debug
#

1.If true, extra processing info will be output (and indexed). You
2.generally won't want to set this to True.
#
debug = False

#

1.noCache
#

1.If true, the 'read message' cache will be ignored. This effectively causes
2.all matching messages to be retrieved and indexed repeatedly; you probably
3.don't want to set this to True.
#

1.Note that if you want to permanently reset the read message cache, delete
2.this file:
#

1.$SPLUNK_HOME/var/lib/splunk/bundles/scripts/getimap.cache
#
noCache = False

#If caching is turned on, we need to retrieve the latest UID from the splunk servers
#This is the userid for a default splunk installation. Change it to whatever user account
#you have set up if you have a custom installation.
splunkuser = admin

#If caching is turned on, we need to retrieve the latest UID from the splunk servers
#This is the password for the default splunk installation. Change it appropriately if you have set
#it up differently.
splunkpassword = changeme

#This is the encrypted password for the splunk installation. Change it appropriately if you have set
#it up differently.
splunkxpassword =

#Path to the splunk host path. If yours is different from the default change this to
#https://:
splunkHostPath = https://localhost:8089

#upper bound for the REST call to return a result (in seconds)
timeout = 10

▶ Reply to This