topic how to make sure that mail has been successfully delivered from splunk email notifications in Reporting

how to make sure that mail has been successfully delivered from splunk email notifications

surekhasplunk — Thu, 01 Feb 2018 10:43:02 GMT

Hi,

I want to send email to a set of user returned from my search query. Now how to keep a track whether they have been successfully delivered or not ?
And if delivered how to get a list of how many mails has been sent to a particular email id in last 1 month for example.

Thanks

Re: how to make sure that mail has been successfully delivered from splunk email notifications

nickhills — Thu, 01 Feb 2018 11:13:13 GMT

Email is a "best effort" delivery mechanism.
It never was intended (nor will ever be) a guaranteed delivery service.

The Splunk logs will only show you that Splunk attempted to send an email, and the initial server accepted it.
What happens downstream has nothing to do with the sender (Splunk in this case), and nor will it be reported if the email is bounced/rejected/lost/delivered.

Now, If you own the server... you can splunk its logs to track delivery success of all emails (not just from Splunk) and correlate them to your alerts if you wish, but only as far as that mailserver can 'see'.

If you need guaranteed delivery, email is not the best choice.

Re: how to make sure that mail has been successfully delivered from splunk email notifications

mayurr98 — Thu, 01 Feb 2018 12:33:11 GMT

Yes I agree with @nickhillscpl, in addition to that if you want the list of all email sent out by splunk refer below:
The Python and splunkd logs would be the place to start. You can run the following query to get e-mail related activity:

index=_internal source=*python.log sendemail

If you run the same search but with splunkd.log instead, there's a field called ssname that gives the search that triggered the alert.

let me know if this helps!