topic Re: Email action for alerts no longer works since Splunk 7.3.6 in Alerting

Email action for alerts no longer works since Splunk 7.3.6

HumanPrinter — Tue, 23 Jun 2020 11:57:15 GMT

Last week we upgraded our Splunk-cluster from version 7.3.5 to 7.3.6. Since that moment, alerts that are triggered no longer are able to send mail.

The _internal index shows an event stating "ERROR sendemail:461 - 'rootCAPath' while sending mail to: xxx@xx"

From other posts it seems to be required to add the list_settings capability to our user roles. However, prior to the update we have had no problems with alert mails without adding this capability to user roles. The release notes for version 7.3.6 don't mention any fix or change in this regard.

Since the documentation is not quite clear about the impact of adding this capability to a user role (what additional possibilities are available to users with this capability) and this didn't seem to be required up until version 7.3.5 we would like to be sure this capability won't harm our setup

Re: Email action for alerts no longer works since Splunk 7.3.6

muhammadamir — Fri, 21 May 2021 18:43:33 GMT

Hi Support, did any body a solution for it. I Just upgrade my splunk from 7.2.2 to 7.3 it works fine, but after this version the email alerts doesn't work. Did anybody able to resolve this issue. Please, let me know ASAP. Thanks.

Re: Email action for alerts no longer works since Splunk 7.3.6

burwell — Fri, 21 May 2021 19:30:49 GMT

Hi. I had the same question of Splunk support. I had asked ffor documentation clarification but it doesn't seem to have made it into this documentation https://docs.splunk.com/Documentation/Splunk/8.2.0/Admin/authorizeconf

Support told me that list_settings allows a user to have access to settings endpoint.

| rest splunk_server=local /services/server/settings

We added it for our users.

Re: Email action for alerts no longer works since Splunk 7.3.6

lweiss — Fri, 21 May 2021 20:55:08 GMT

Hi @muhammadamir

This is a known issue with v7.3.6; we ran into it at my company when we upgraded.

To resolve the problem you'll need to add the "admin_all_objects" capability to anyone that needs to send an email alert. There's more info about the issue in the release notes: Known issues - Splunk Documentation

Good luck!