topic Re: Where does splunk log email failures in Reporting

Where does splunk log email failures

adoshi — Mon, 08 Jun 2020 23:56:38 GMT

It seems that Splunk is not sending the emails when the alerts are triggered. Is there any place where I can see what errors were logged when splunk tried to send the alert email?

Re: Where does splunk log email failures

yannK — Wed, 11 Jul 2012 01:29:38 GMT

Check in $SPLUNK_HOME/var/log/splunk/python.log

or use the search :
index=_internal source=*python.log*

Re: Where does splunk log email failures

adoshi — Wed, 11 Jul 2012 02:22:24 GMT

Thank you.

Re: Where does splunk log email failures

woodcock — Fri, 01 Jun 2018 13:59:50 GMT

You should click Accept on this answer, @adoshi, to close the question.

Re: Where does splunk log email failures

gjanders — Sat, 02 Jun 2018 22:41:26 GMT

I created an alert called "AllSplunkEnterpriseLevel - Email Sending Failures", if you needed an example it's available in github here or the app with all the alerts is available here, Alerts For Splunk Admins

Re: Where does splunk log email failures

gjanders — Sat, 02 Jun 2018 22:42:46 GMT

@woodcock it might be worth noting this is a 2012 post and the user was last seen in 2015...

Re: Where does splunk log email failures

Amandeepsin — Thu, 27 Dec 2018 18:11:29 GMT

Check

cat /var/log/maillog

Check if any connection is refused by SMTP Server... If yes, then inform your IT Team

Re: Where does splunk log email failures

johnquinn — Tue, 11 Feb 2020 22:23:31 GMT

Maillog doesn't exist on Insights for infrastructure and our python.log file is empty.
SMTP server settings are set the same way as many other systems, but the alerts from splunk do not get sent.
Need a way to troubleshoot the issues.

Thanks,

Re: Where does splunk log email failures

Amandeepsin — Fri, 14 Feb 2020 01:41:22 GMT

Try to check under Server Settings and Then Email Settings
Afterwards check Alert Action on Splunk UI