topic Re: How to send Splunk email alerts through AWS SES in Reporting

How to send Splunk email alerts through AWS SES

jobycxa — Mon, 04 Jul 2011 06:41:10 GMT

Hi,

I am working on ubuntu servers on AWS and wants to use SES functionality of AWS to send splunk email alerts, is this possible?

Re: How to send Splunk email alerts through AWS SES

dwaddle — Mon, 04 Jul 2011 21:20:39 GMT

I'd say "sure, it's possible -- if you're willing to write some code to do it". The default Splunk "send email" action uses plain old SMTP under the covers. You could modify $SPLUNK_HOME/etc/apps/search/bin/sendemail.py to use the Amazon SES API. These changes could get overlaid during an upgrade and would probably not be supported by Splunk support.

Re: How to send Splunk email alerts through AWS SES

jobycxa — Tue, 05 Jul 2011 04:47:55 GMT

It'll be great if you can throw some light on this as i am not familiar with python scripts.Any documentation link for this?

Re: How to send Splunk email alerts through AWS SES

dwaddle — Tue, 05 Jul 2011 21:45:16 GMT

This really isn't in an area of publicly documented Splunk. You're changing what is basically an exposed implementation detail. If you don't know python, your job probably just got a little harder. The documentation for the sendemail command ( http://www.splunk.com/base/Documentation/latest/SearchReference/Sendemail ) might help you, as well as the documentation around alert_actions.conf ( http://www.splunk.com/base/Documentation/latest/Admin/Alertactionsconf ). There's also an article at Amazon ( http://aws.amazon.com/articles/2405502737055650 ) that provides an example of SES in python.

Re: How to send Splunk email alerts through AWS SES

philipp_schneid — Fri, 17 Feb 2012 08:20:31 GMT

Amazon now offers SMTP Server with their AWS SES service.
We got it working now.
Here is how you do it:
go to amazon and set the SMTP incl. one user up. (see Amazon doc)

In Splunk:
Mail host: (choose the one amazon tells you)
email-smtp.us-east-1.amazonaws.com:465
Security: Enable SSL
UserName: amazon crypto username
Pass: abc
Link hostname: your external IP of the splunkserver
send emails as: the verfied Email adress

That setup worked for us

Re: How to send Splunk email alerts through AWS SES

Selim_Imoberdor — Fri, 09 Mar 2012 13:27:30 GMT

Update to the answer of Philipp Schneider:

The Link hostname is NOT your external IP of the splunkserver, but the internal IP! Because if you're enable the PDF Server for Linux to schedule PDF reports, you will not be able to generate PDF's with your external IP!

Cheers

Selim

System Administrator, Junior - Cloud Development

coresystems ag

Villa im Park | Dorfstrasse 69

5210 Windisch | Switzerland

Re: How to send Splunk email alerts through AWS SES

mchandramouli — Wed, 10 Oct 2012 14:26:46 GMT

philippschneider's answer worked with a minor change - instead of enable SSL, I had to use Enable TLS.

Mail host: email-smtp.us-east-1.amazonaws.com (no port mentioned)
Enable TLS
Username: SESUSERNAME
Password: SESPASSWORD
send email as: verified email address

Re: How to send Splunk email alerts through AWS SES

klausg — Tue, 12 May 2015 20:00:17 GMT

Thanks, the "No Port" comment prevented me from ripping out the little hair I have left 😉