topic Re: Unable to send test email from Splunk in Alerting

Unable to send test email from Splunk

mukeshprasad4u — Sat, 08 Apr 2023 13:09:28 GMT

I am trying configuring gmail smtp but when sending test email using below command getting below error.

Any help will be appreciated.

Command:

index=_internal | head 1 | sendemail to="XXXXXXXX@gmail.com" format="html" server=smtp.gmail.com:587 use_tls=1

command="sendemail", (530, b'5.7.0 Authentication Required. Learn more at\n5.7.0 https://support.google.com/mail/?p=WantAuthError w22-20020a1709027b9600b0019a593e45f1sm196622pll.261 - gsmtp', 'splunk@ip-172-31-36-251.ap-south-1.compute.internal') while sending mail to: @XXXXXXX@gmail.com

Re: Unable to send test email from Splunk

marioespbaires — Thu, 02 Nov 2023 22:28:54 GMT

Hello,

by any chance, did you find a solution for this? I got the same issue right now.

Re: Unable to send test email from Splunk

isoutamo — Fri, 03 Nov 2023 09:05:08 GMT

Currently gmail don't allow use smtp server as earlier. Instead it wants to use more secure authentication. For that reason the old way is not working anymore with Splunk. Fortunately they have implemented 2-factor authentication and additional app password feature which you could use.

Here is steps to do it

https://support.google.com/accounts/answer/185833?sjid=13755993998155727325-EU#:~:text=to%2520your%2520data.-,sign%2520in%2520with%2520app%2520passwords,-Tip%253A%2520App%2520Passwords
1. Check above instructions and ensure that you have 2-step verification on (probably this is as Google has enabled it for all)
2. Create a new app password for your Splunk server
3. Login to your local splunk instance

index=_internal | head 1 | sendemail to="<your test email recipient>" subject=test sendresults=true format=table sendcsv=false

r. Ismo

Re: Unable to send test email from Splunk

dimmitrisd — Wed, 15 Jul 2026 14:09:24 GMT

The following procedure worked for me fine. I created a mini guide:

1. Setting Up Google SMTP in Splunk To successfully send emails from Splunk via Gmail, you must use an App Password rather than your regular account password.

Generate App Password: Go to your Google Account settings, enable 2-Step Verification, and generate a 16-character App Password.

Configure Splunk Email Settings: Navigate to Settings > System settings > Email alert settings. Mail host: smtp.gmail.com:465. Email security: SSL. Username: Your full Gmail address. Password: Paste the 16-character (without spaces) App Password here. Click Save.

2. How to Trigger/Test the Alert You can verify your configuration by running a manual test command in the search bar. This confirms your SMTP settings are correct without needing to wait for a real event.

Run Test Command: Use the following command in the Splunk Search bar: index=_internal | head 1 | sendemail to="your_email@example.com" subject="Test Alert" message="Splunk SMTP is working" sendresults=true format=table sendcsv=false.

Expected Outcome: If the configuration is correct, you will receive a test email, and the search will display "The search completed successfully". 3. Setting Up an Automated Alert

Once testing is successful, configure an automated trigger for new events: Create Alert: Perform a search for your specific event (e.g., index="your_index"). Save as Alert: Click Save As > Alert. Schedule: Set the Alert type to Scheduled. Frequency: To check every minute, select Run on Cron Schedule and enter */1 * * * *. Time Range: Set the time range to "Last 1 minute" to ensure the alert only triggers for new events within that specific window. Trigger Condition: Set Number of results to is greater than 0. Add Action: Select Add Actions > Send email and enter the recipient address. Important Note: These steps apply to the Enterprise/Trial version. Please be aware that the Free version of Splunk has limitations that prevent these email alert actions from working.