https://community.splunk.com/t5/Reporting/Why-are-the-reports-not-sending-email-of-more-than-70-events-in/m-p/351427#M6179 <P>Reports and sendemail not sending an email of more than about 70 events - The maximum number of events varies depending of how much data per event. What I see is that sendemail.py is failing.<BR /><BR /> Sendemail in the search line is doing the same, and the error is: <STRONG><EM>External search command 'sendemail' returned error code 1.</EM></STRONG></P> <P>I tried to add an increase several parameters in the .conf files like indicated on the groups but it did not make a difference <BR /> <A href="https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html">https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html</A></P> <P>Here is the splunkd.log filtered by the scheduler and sendemail events examples:</P> <P><STRONG>Scheduler:</STRONG> </P> <PRE><CODE>04-18-2018 15:00:00.780 -0300 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://quebec:8000/app/search/@go?sid=scheduler__admin__search__RMD5305669048a8da3b1_at_1524074400_13" "ssname=R4_TEST" "graceful=True" "trigger_time=1524074400" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__admin__search__RMD5305669048a8da3b1_at_1524074400_13/results.csv.gz"': for line in csvr: 04-18-2018 15:00:00.780 -0300 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://quebec:8000/app/search/@go?sid=scheduler__admin__search__RMD5305669048a8da3b1_at_1524074400_13" "ssname=R4_TEST" "graceful=True" "trigger_time=1524074400" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__admin__search__RMD5305669048a8da3b1_at_1524074400_13/results.csv.gz"': _csv.Error: line contains NULL byte </CODE></PRE> <P><STRONG>Sendemail</STRONG></P> <PRE><CODE>04-12-2018 12:00:05.484 -0300 ERROR script - sid:scheduler__admin__search__RMD5bf6f3132e2acfda9_at_1523545200_31 External search command 'sendemail' returned error code 1. </CODE></PRE> <P>Appreciate your help, thanks</P> Fri, 20 Apr 2018 11:53:55 GMT hugohctint 2018-04-20T11:53:55Z https://community.splunk.com/t5/Reporting/Why-are-the-reports-not-sending-email-of-more-than-70-events-in/m-p/351427#M6179 <P>Reports and sendemail not sending an email of more than about 70 events - The maximum number of events varies depending of how much data per event. What I see is that sendemail.py is failing.<BR /><BR /> Sendemail in the search line is doing the same, and the error is: <STRONG><EM>External search command 'sendemail' returned error code 1.</EM></STRONG></P> <P>I tried to add an increase several parameters in the .conf files like indicated on the groups but it did not make a difference <BR /> <A href="https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html">https://answers.splunk.com/answers/542862/how-to-overcome-csv-max-results-to-email.html</A></P> <P>Here is the splunkd.log filtered by the scheduler and sendemail events examples:</P> <P><STRONG>Scheduler:</STRONG> </P> <PRE><CODE>04-18-2018 15:00:00.780 -0300 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://quebec:8000/app/search/@go?sid=scheduler__admin__search__RMD5305669048a8da3b1_at_1524074400_13" "ssname=R4_TEST" "graceful=True" "trigger_time=1524074400" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__admin__search__RMD5305669048a8da3b1_at_1524074400_13/results.csv.gz"': for line in csvr: 04-18-2018 15:00:00.780 -0300 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://quebec:8000/app/search/@go?sid=scheduler__admin__search__RMD5305669048a8da3b1_at_1524074400_13" "ssname=R4_TEST" "graceful=True" "trigger_time=1524074400" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler__admin__search__RMD5305669048a8da3b1_at_1524074400_13/results.csv.gz"': _csv.Error: line contains NULL byte </CODE></PRE> <P><STRONG>Sendemail</STRONG></P> <PRE><CODE>04-12-2018 12:00:05.484 -0300 ERROR script - sid:scheduler__admin__search__RMD5bf6f3132e2acfda9_at_1523545200_31 External search command 'sendemail' returned error code 1. </CODE></PRE> <P>Appreciate your help, thanks</P> Fri, 20 Apr 2018 11:53:55 GMT https://community.splunk.com/t5/Reporting/Why-are-the-reports-not-sending-email-of-more-than-70-events-in/m-p/351427#M6179 hugohctint 2018-04-20T11:53:55Z