topic Re: Email notifications for alerts are not working in Alerting

Email notifications for alerts are not working

jenojasko — Tue, 11 Jul 2017 12:51:06 GMT

I've saved a search and set up an alert to run the search every 10 minutes and send out email notification if the number of result is greater then 0, it was working fine at the start (about 5 months ago) after some time it only sent out the email 7 out of 10 times and for the last 2 days I haven't got any email but I can see that the alert was triggered a couple of times in the trigger history. What could be causing this issue? (Splunk 6.3)

Thanks,
Jeno

Re: Email notifications for alerts are not working

gcusello — Tue, 11 Jul 2017 14:28:17 GMT

Hi jenojasko,
in your alert is there an attachement? if there is an attachement verify if it exceeds you email limits: test if your alert runs without attachements.
You can verify this also viewing splunkd.log and searching for email error messages.
Bye.
Giuseppe

Re: Email notifications for alerts are not working

jenojasko — Wed, 12 Jul 2017 06:09:31 GMT

Hi Giuseppe,

there is no attachment in the email. Only text in the body. Also I don't have splunk installed, only using the browser version.

Regards,
Jeno

Re: Email notifications for alerts are not working

gcusello — Thu, 13 Jul 2017 07:29:28 GMT

Hi jenojasko,,
usually the problem is on attachments, verify that you don't exceed email body limits.

See in splunkd.log (directly on file or using Splunk search index=_internal sourcetype=splunkd) if there are email errors or warnings, this could guide you in error debugging.

Bye.
Giuseppe

Re: Email notifications for alerts are not working

jenojasko — Thu, 13 Jul 2017 13:02:25 GMT

Hi Giuseppe,

Thanks for your assist, tried it and there were no sign of any error, but the emails are still not sending sadly. Also every email has the same body without any attachment.

Thanks,
Jeno