topic Unable to send test email from Splunk in Alerting

Unable to send test email from Splunk

mukeshprasad4u — Sat, 08 Apr 2023 13:09:28 GMT

I am trying configuring gmail smtp but when sending test email using below command getting below error.

Any help will be appreciated.

Command:

index=_internal | head 1 | sendemail to="XXXXXXXX@gmail.com" format="html" server=smtp.gmail.com:587 use_tls=1

command="sendemail", (530, b'5.7.0 Authentication Required. Learn more at\n5.7.0 https://support.google.com/mail/?p=WantAuthError w22-20020a1709027b9600b0019a593e45f1sm196622pll.261 - gsmtp', 'splunk@ip-172-31-36-251.ap-south-1.compute.internal') while sending mail to: @XXXXXXX@gmail.com

Re: Unable to send test email from Splunk

marioespbaires — Thu, 02 Nov 2023 22:28:54 GMT

Hello,

by any chance, did you find a solution for this? I got the same issue right now.

Re: Unable to send test email from Splunk

isoutamo — Fri, 03 Nov 2023 09:05:08 GMT

Currently gmail don't allow use smtp server as earlier. Instead it wants to use more secure authentication. For that reason the old way is not working anymore with Splunk. Fortunately they have implemented 2-factor authentication and additional app password feature which you could use.

Here is steps to do it

https://support.google.com/accounts/answer/185833?sjid=13755993998155727325-EU#:~:text=to%2520your%2520data.-,sign%2520in%2520with%2520app%2520passwords,-Tip%253A%2520App%2520Passwords
1. Check above instructions and ensure that you have 2-step verification on (probably this is as Google has enabled it for all)
2. Create a new app password for your Splunk server
3. Login to your local splunk instance

index=_internal | head 1 | sendemail to="<your test email recipient>" subject=test sendresults=true format=table sendcsv=false

r. Ismo