#DAVMAIL TROUBLESHOOTING INSTALL#
#DAVMAIL TROUBLESHOOTING UPDATE#

Make sure that only ONE system is running the inputs for the IMAP app otherwise you will get email duplications. Please see this link for more instructions: Įnable the index and replication: =- nf

#DAVMAIL TROUBLESHOOTING INSTALL#

Install for Distributed Splunk designsįor those who are running a distributed Splunk design or HA: ie separate forwarders, search heads, indexers, etc. This app uses the same index 'mail' as the original app, so all past indexed data will still exist. Note: If you have any users with private saved searches, dashboards, alerts, then you will need to change their user app directory name so it appears for this app. Disable the original app via the Splunk Apps UI.Copy imap/metadata/ta over to IMAPmailbox/metadata/.Copy imap/local/* files/directories over to IMAPmailbox/local/.Install this app as instructions above, it will install in a new location than the original app. Instructions if you are currently using Splunk for IMAP v1.20 and want to upgrade to this new app. Upgrading from the original 'Splunk for Imap' app Run the upgrade via the Splunk App management UI.Comment out the 'definition = index=mail' in default/nf file.

Remove 'index = mail' reference in default/nf.

If you want the IMAP output to go to the default Splunk index:

For Windows users please disable the unix script and enable the windows one in file default/nfīy default, the IMAP app will create a new Splunk index named 'mail'.Or you can run the setup page via the Splunk UI under Apps. See the comments in the default/nf file for more details about all required and optional settings. Copy default/nf to local/nf and provide the required settings for connecting to your IMAP server (server, user, password, port, etc.).Copy the IMAPmailbox app directory into $SPLUNK_HOME/etc/apps/ location.Look further down for distributed splunk design instructions. This section is to install on a centralized splunk setup. You can help make IMAP Mailbox better by contributing: Getting Started New Install The original app will still work fine for Splunk v5 users and below. So I decided (with permission of Splunk) to write an update! It cannot be named the same due to Splunk development naming rules, but this app can be considered the new version going forward and thus started it at version 2.0. It appears the Splunk employee who created the original app is not able to maintain it.

#DAVMAIL TROUBLESHOOTING UPDATE#

This is an update to the 'Splunk for IMAP' v1.20 app. Each email message will be treated as a separate splunk event. This app will download email messages from an IMAP account/mailbox and index it into Splunk.

Davmail troubleshooting