topic Re: Email Configuration Setting is not working for smtp.gmail.com in Monitoring Splunk

Email Configuration Setting is not working for smtp.gmail.com

sdubey_splunk — Tue, 29 Sep 2020 22:50:43 GMT

We have configured Email Settings referring https://www.splunk.com/blog/2014/06/27/splunk-alerts-using-gmail-twitter-phone-calls-and-much-more.html and
https://answers.splunk.com/answers/38624/how-to-configure-email-alert-using-gmail-smtp.html?utm_source=newcase&utm_medium=clickquestion&utm_campaign=Grabtaxi&utm_term=Email%20Configuration%20Setting%20is%20not%20working%20for%20smtp.gmail.com&utm_content=1 links.

But still we are unable to send any mail from Splunk to any of the email id.

While looking in the python.log file we can see below error.

2018-12-05 11:25:16,536 +0000 ERROR sendemail:137 - Sending email. subject="Splunk Alert: Email Test Alert", results_link="http://seim-server-ip.com:8080/app/search/@go?sid=scheduler__jeet__search__RMD5fc99695b46fc7eb6_at_1544009100_34778_49871F58-62F1-4AE3-A543-3E01E6B37A56", recipients="[u'san.du@ourdomain.com', u'ext.xyz.aplha@ourdomainext.com', u'testemail@in.ourdomain.com']", server="smtp.gmail.com:587"

2018-12-05 11:25:16,536 +0000 ERROR x - (534, '5.7.14 Please log in via\n5.7.14 your web browser and then try again.\n5.7.14 Learn more at\n5.7.14 https://support.google.com/mail/answer/78754 k26sm37700910pgf.65 - gsmtp') while sending mail to: san.du@ourdomain.com', ext.xyz.aplha@ourdomainext.com

Kindly request you to help us on the same.

Re: Email Configuration Setting is not working for smtp.gmail.com

sdubey_splunk — Tue, 29 Sep 2020 22:50:45 GMT

As per https://support.google.com/accounts/answer/6010255?hl=en :If an app or device doesn’t meet our security standards, Google will block anyone who tries to sign in from that app or device. Because these apps and devices are easier to break into, blocking them helps keep your account safe.

Change your settings to allow less secure apps into your account. We don't recommend this option because it can make it easier for someone to break into your account. If you want to allow access anyway, follow these steps:

To Fix:
1) I logged into gmail account.

2) Go to https://www.google.com/settings/security/lesssecureapps and Turn On this feature.

3) Go to https://accounts.google.com/DisplayUnlockCaptcha and click Continue.

4) I tried to send email from Splunk:
index=_internal | head 1 | sendemail to="myemailid@gmail.com" format="html" server=smtp.gmail.com:587 use_tls=1

5)And I was able to see the emails send from Splunk to gmail successfully.

Summary: Issue is external to Splunk, Google was blocking emails from Splunk.

Re: Email Configuration Setting is not working for smtp.gmail.com

johnkimber — Fri, 26 Apr 2019 07:05:54 GMT

It is because Google blocks sign-in attempts from apps which do not use modern security standards (mentioned on their support page). You can however, turn on/off this safety feature by going to the link below:

Go to this link and select Turn On
https://www.google.com/settings/security/lesssecureapps

Moreover google block an ip when you try to send a email since a unusual location, so, you can unblock in the next link
https://support.google.com/accounts/answer/6009563

and clicked in

accounts.google.com/DisplayUnlockCaptcha .