Alerting

Email notifications for alerts are not working

New Member

I've saved a search and set up an alert to run the search every 10 minutes and send out email notification if the number of result is greater then 0, it was working fine at the start (about 5 months ago) after some time it only sent out the email 7 out of 10 times and for the last 2 days I haven't got any email but I can see that the alert was triggered a couple of times in the trigger history. What could be causing this issue? (Splunk 6.3)

Thanks,
Jeno

0 Karma

SplunkTrust
SplunkTrust

Hi jenojasko,
in your alert is there an attachement? if there is an attachement verify if it exceeds you email limits: test if your alert runs without attachements.
You can verify this also viewing splunkd.log and searching for email error messages.
Bye.
Giuseppe

0 Karma

New Member

Hi Giuseppe,

there is no attachment in the email. Only text in the body. Also I don't have splunk installed, only using the browser version.

Regards,
Jeno

0 Karma

SplunkTrust
SplunkTrust

Hi jenojasko,,
usually the problem is on attachments, verify that you don't exceed email body limits.

See in splunkd.log (directly on file or using Splunk search index=_internal sourcetype=splunkd) if there are email errors or warnings, this could guide you in error debugging.

Bye.
Giuseppe

0 Karma

New Member

Hi Giuseppe,

Thanks for your assist, tried it and there were no sign of any error, but the emails are still not sending sadly. Also every email has the same body without any attachment.

Thanks,
Jeno

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!