topic Re: Issue with Sending Splunk Alert Emails via Postfix SMTP Server in Alerting

Issue with Sending Splunk Alert Emails via Postfix SMTP Server

Maxime — Wed, 07 Aug 2024 10:01:04 GMT

Hello everyone,

I am encountering an issue with sending emails for the alerts I have configured on Splunk. Here are the steps I followed:

SMTP Server Configuration:
- I set up an SMTP server using Postfix on a virtual machine (VM).
- I also configured the firewall on this VM to allow SMTP traffic.
Splunk Configuration:
- In Splunk, I configured the email server settings using my Postfix server information.
- I verified the settings under Settings -> Server settings -> Email settings, and everything seems correct.
Alert Configuration:
- I created several alerts and configured the "Send Email" action for each alert.
- I provided the recipients, subject, and email content.

Despite these configurations, I am not receiving any emails when the alerts are triggered.

Additional Details:

I tested sending emails from the command line on the VM with Postfix, and it works correctly.
I checked Splunk logs (splunkd.log) and did not find any obvious errors related to email sending.
Postfix logs show that email requests do not seem to be reaching the server.

Questions:

Are there any additional steps I might have missed in the Splunk configuration for sending emails?
How can I diagnose why emails are not being sent from Splunk?
Are there specific logs or configurations I should check again?

Thank you in advance for your help!

Re: Issue with Sending Splunk Alert Emails via Postfix SMTP Server

PickleRick — Wed, 07 Aug 2024 12:55:02 GMT

Check _internal index for events related to sendemail.py

index=_internal sendemail.py

Re: Issue with Sending Splunk Alert Emails via Postfix SMTP Server

Maxime — Wed, 07 Aug 2024 13:26:53 GMT

I am encountering an issue with sending emails from Splunk. After some investigation, I discovered that my Outlook email address is not authorized to send emails as splunk@splunkubuntu.

Details:

I have configured Splunk to use my Outlook email address for sending alert notifications.
The SMTP server settings in Splunk are correctly configured to use my Outlook credentials.
However, when an alert is triggered, the emails are not sent. The error message indicates that my Outlook email address is not authorized to send emails as splunk@splunkubuntu.

Steps Taken:

Verified the SMTP server settings in Splunk (Settings -> Server settings -> Email settings).
Tested sending emails directly from Outlook, which works fine.
Checked the Splunk logs (splunkd.log) for any related errors and found the authorization issue.

Questions:

How can I configure my Outlook email address to be authorized to send emails from Splunk?
Are there specific settings or permissions needed within Outlook or Splunk to resolve this issue?
Has anyone faced a similar issue and found a solution ?

Thank you in advance for your assistance!

Re: Issue with Sending Splunk Alert Emails via Postfix SMTP Server

PickleRick — Wed, 07 Aug 2024 13:44:49 GMT

It is an Outlook question if you can enable it to send email using your credentials from Splunk or any other external service. As far as I remember, you can't just use user/password to authenticate to Outlook's SMTP and Splunk doesn't support (at least not using built-in sendemail.py) alternative modes of authentication.