topic Splunk Email alerts in Alerting

Splunk Email alerts

Irosha — Wed, 13 Jan 2016 16:46:43 GMT

Hi Experts,

I have configured email alerts on my splunk server. when i run the sendemail command;

Eg:
index=syslog | head 5 | sendemail to="Test.User@Test.local" server="smtp.test.local" subject="Here is an email notification" message="This is an example message"

I am getting below error message

command="sendemail", (421, '4.3.2 Service not available') while sending mail to: Test.User@Test.local

Any idea what might causing this issue ?

Re: Splunk Email alerts

Irosha — Wed, 13 Jan 2016 16:48:37 GMT

This is the search command i am trying to run;

index=syslog | head 5 | sendemail to=Test.User@Test.local server=smtp.test.local subject="Here is an email notification" message="This is an example message"

Re: Splunk Email alerts

richgalloway — Wed, 13 Jan 2016 17:00:45 GMT

Have you looked at splunkd.log?

Re: Splunk Email alerts

dgrubb_splunk — Wed, 13 Jan 2016 18:27:39 GMT

With Email, sometimes it is just easier to attempt to deliver a message using telnet from the command line of the server to see what is the issue with email server.

Here is great technet article that describes the smtp commands:

https://technet.microsoft.com/en-us/library/aa995718%28v=exchg.65%29.aspx

If you get the same error response you can eliminate Splunk from the issue, and focus on the mail server, from address, to address etc as being the issue.

Re: Splunk Email alerts

Irosha — Fri, 15 Jan 2016 15:44:24 GMT

there was an access list configured on our SMTP server. that was the issue. many thanks for the help.