topic Re: After configuring email alerts, why am I not receiving all emails from Splunk Enterprise? in Alerting

After configuring email alerts, why am I not receiving all emails from Splunk Enterprise?

varmamkm — Fri, 28 Sep 2018 08:37:18 GMT

I have configured triggered alerts & email alerts for an alert which runs every hour with custom count >0 with trigger for each result.

I see triggered alerts for every hour and i don't see any emails triggered for every hour. I get only one email in the morning and thats it..

Can you please help me figure out which configuration i should change so that i receive emails for every triggered alert?

Re: After configuring email alerts, why am I not receiving all emails from Splunk Enterprise?

harishalipaka — Fri, 28 Sep 2018 12:41:48 GMT

@varmamkm

can u check your scheduled time .put it cron schedule make it * * * * * it will run every one minute

Re: After configuring email alerts, why am I not receiving all emails from Splunk Enterprise?

jlelli — Fri, 28 Sep 2018 12:51:47 GMT

As @harishalipaka said: change the scheduled time on Cron; the expression for "every hour" is: 0 0 * ? * *

Re: After configuring email alerts, why am I not receiving all emails from Splunk Enterprise?

varmamkm — Fri, 28 Sep 2018 12:59:25 GMT

I have tried both (cron & run every hour) options but no luck.. i see them triggered and logged under "Activity->Triggered Alerts" but it is not triggering emails

Re: After configuring email alerts, why am I not receiving all emails from Splunk Enterprise?

harishalipaka — Fri, 28 Sep 2018 13:32:35 GMT

@varmamkm

docs.splunk.com/Documentation/SplunkCloud/7.0.5/Alert/Reviewtriggeredalerts

Re: After configuring email alerts, why am I not receiving all emails from Splunk Enterprise?

burwell — Fri, 28 Sep 2018 21:40:03 GMT

Be sure that your Splunk instance had configuration to send to your mailserver

In /opt/splunk/etc/system/local/alert_actions.conf

[email]
from       = splunk@mydomain.com
mailserver = myserver.mydomain:25