topic Re: Saved Searches not emailing out in Splunk Search

Saved Searches not emailing out

jtwcarboy — Thu, 03 Jun 2010 01:17:04 GMT

I have saved searches and all of a sudden with no changes they are returning this error to the python.log file.

ERROR Error in 'sendemail': (128, 'Network is unreachable') while sending mail to: user@user.com

I checked manually and i can send an email from this server to myself just splunk isnt able to send emails and im not sure how to resolve this issue. I can telnet over 25 to my mailhost so this has to be something simple to do with splunk itself.

Any help is appreciated.

Re: Saved Searches not emailing out

Lowell — Thu, 03 Jun 2010 04:23:47 GMT

Have you tried running the sendemail command manually? I'm guessing that you are using the scheduled saved searched with email alerting? If you are running on a unix OS with a local MTA, then you may want to forward your email to localhost and let your local MTA handle there rest (this will give you a small buffer if you do experience a temporary network outage)

Re: Saved Searches not emailing out

Lowell — Thu, 03 Jun 2010 04:25:15 GMT

What host is set in $SPLUNK_HOME/etc/system/local/alert_actions.conf in the [email] stanza. The host is set with hostname=<hostname>

Re: Saved Searches not emailing out

deletethisaccou — Fri, 04 Jun 2010 14:01:17 GMT

Hi,

Have you done the right settings at this page? http://lxs-monet:8000/en-US/manager/unix/configs/conf-alert_actions/email/?action=edit

Make sure that you entered an VALID sender-email adress. With valid, I mean: [somename]@[somedomain].com Somename doesn't have to be a valid name (at my configuration) Mine email function did not work until I changed the sender-adress.. 😉

Re: Saved Searches not emailing out

jtwcarboy — Wed, 09 Jun 2010 22:07:11 GMT

There is no alert_actions.conf file as im not using alerts but im only running saved searches every morning but not alerts.

Also what is the usage for the sendemail.py command as when i run it it get this:

import: Unable to connect to X server ().
import: Unable to connect to X server ().
/opt/splunk/etc/searchscripts/sendemail.py[4]: from: not found
import: Unable to connect to X server ().
/opt/splunk/etc/searchscripts/sendemail.py[8]: importanceMap: not found
/opt/splunk/etc/searchscripts/sendemail.py[9]: highest:: not found

Re: Saved Searches not emailing out

jtwcarboy — Wed, 09 Jun 2010 22:08:57 GMT

I cannot get to that website you posted and also in the saved search box i dont have a field for "From" or "Sender" But i must say that my saved searches have worked for 1yr then all of a sudden stopped with that error i put in the original post.

Re: Saved Searches not emailing out

jrodman — Fri, 02 Jul 2010 23:31:33 GMT

In splunk terminology, searches that are scheduled and send emails, are alerts. The email sender is saying it cannot access your mail server. The alert_actions config screen is where you say how for it to reach your mailserver.

Re: Saved Searches not emailing out

jrodman — Mon, 28 Sep 2020 09:14:34 GMT

If you never configured alert_actions, sendemail would try to connect to localhost, port 25, to send the email. It's possible something about your netwrorking configuration or environment has changed. It seems quite likely though that configuring the alert_actions as in the above url (but using your splunk server) will resolve the issue.