topic Re: email not sending from windows search head in Getting Data In

email not sending from windows search head

tyronetv — Fri, 29 May 2015 15:11:59 GMT

From splunkd.log

05-29-2015 07:53:02.696 -0700 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+sourcetype%3Dt2_app+OR+sourcetype%3Ddis+iview2+%22%3Fdoc%3D%22+OR+%22%26doc%3D%22+%7C++timechart+span%3D1h+count+by+host+%7C+sendemail+to%3D%22tyrone.vaughn%40transcentra.com%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1432911162651 sent a 0 byte response after earlier claiming a Content-Length of 2160!

=============
This was working until recently. No changes that I am aware of on the machine or the environment, but I can't send email out any more. Above is the log entry when I execute that search from the interface. The interfaces responds with No connection could be made because the target machine actively refused it while sending mail to: (my email address).

I can send email from Powershell using:

 $EmailFrom = "(source address)"
 $EmailTo = "(my address, same as above)"
 $Subject = "Test from CLI"
 $Body = "Testing.. 1 2 3"
 $SMTPServer = "(my relay, same one in Splunk config)
 $SMTPClient =  New-Object Net.Mail.SmtpClient($SMTPServer, 25)
 $SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)

So I don't think it is a machine issue.

Re: email not sending from windows search head

dmaislin_splunk — Fri, 29 May 2015 15:30:38 GMT

Do a test alert email preview from the UI, and check your splunkd.log

Re: email not sending from windows search head

tyronetv — Fri, 29 May 2015 15:45:24 GMT

"test alert email preview" Could you explain that to me?

I did do an attempted send via "sendemail" from the search line and received the same errors.

Re: email not sending from windows search head

dmaislin_splunk — Fri, 29 May 2015 15:49:29 GMT

Not sure what version you are using in Splunk, but in any case, just look in the $SPLUNK_HOME/var/log/splunk/splunkd.log for clues.

Re: email not sending from windows search head

tyronetv — Fri, 29 May 2015 16:00:03 GMT

See above. I included a splunkd.log output.