topic Re: Why is my triggered alert email not sending? in Alerting

Why is my triggered alert email not sending?

jbouch03 — Wed, 29 Oct 2014 18:15:38 GMT

Hi,
I'm having an issue with my Splunk server. I'm trying to setup some alerts, and have entered all my email relay data under the email settings. As a test, I created an alert that contains the following search:

index=_internal | head 1

The alert is triggered, but I don't receive an email. I have checked the mail relay and it seems like the message is going through. But I still don't receive anything. As another test I did the following search:

index=_internal | head 1 | sendemail to="<my email address>" format=raw sendresults=1 server=<smtp relay> footer="Sent from Splunk." from="SplunkAlerts" subject="Splunk Alert" message="The following Splunk Alert has been fired:"

When I run this search I receive the email. Is their something I'm missing in my configuration for the alerts? Any help that you can provide would be greatly appreciated.

Re: Why is my triggered alert email not sending?

martin_mueller — Wed, 29 Oct 2014 18:32:42 GMT

Anything suspicious in index=_internal source=*python.log?

Re: Why is my triggered alert email not sending?

bkondakindi — Wed, 29 Oct 2014 18:45:28 GMT

have you configured mail servers on splunk side ?

check the alerts.conf file.

Re: Why is my triggered alert email not sending?

jbouch03 — Wed, 29 Oct 2014 19:18:00 GMT

the alert_actions.conf is configured. Is there a separate .conf file that needs to be configured?

Re: Why is my triggered alert email not sending?

jbouch03 — Wed, 29 Oct 2014 19:20:52 GMT

As far as I can tell everything looks correct. I get the INFO statements but I don't see any ERROR or WARN flags.

Re: Why is my triggered alert email not sending?

the_wolverine — Wed, 29 Oct 2014 19:21:22 GMT

Check the ~/splunk/var/log/splunk/python.log which is where all the sendemail errors will be written.

Re: Why is my triggered alert email not sending?

jbouch03 — Wed, 29 Oct 2014 20:02:23 GMT

I found the issue. It wasn't with Splunk or the mail relay. The external exchange server that we need to use (provided by our parent company) was marking it as spam. Still can't figure out why the manual search didn't get marked as spam, but the alert did; however, its working now. Thanks for all your help.

Re: Why is my triggered alert email not sending?

ppanchal — Wed, 04 Apr 2018 22:02:51 GMT

How did you identify that the external server was marking the email as spam. Is there a way we can search for all the spam marked emails in splunk?

Re: Why is my triggered alert email not sending?

amanediel — Thu, 04 Oct 2018 09:43:18 GMT

Hi @jbouch03,

How did you find this issue?

Re: Why is my triggered alert email not sending?

eholz1 — Fri, 16 Aug 2019 23:25:17 GMT

on splunk 7.3.1 there is no such thing as an alerts.conf file

Re: Why is my triggered alert email not sending?

Sir_SplunkALot — Tue, 25 May 2021 15:20:25 GMT

Thank you for this!! I was having the exact same issue and couldn't figure out why until I read this thread. Apparently the Splunk SH we were using wasn't setup to send mail in general. We tried another search head and it worked perfectly. This helped A LOT!