Alerting

Email notifications for alerts are not working

jenojasko
New Member

I've saved a search and set up an alert to run the search every 10 minutes and send out email notification if the number of result is greater then 0, it was working fine at the start (about 5 months ago) after some time it only sent out the email 7 out of 10 times and for the last 2 days I haven't got any email but I can see that the alert was triggered a couple of times in the trigger history. What could be causing this issue? (Splunk 6.3)

Thanks,
Jeno

0 Karma

gcusello
Legend

Hi jenojasko,
in your alert is there an attachement? if there is an attachement verify if it exceeds you email limits: test if your alert runs without attachements.
You can verify this also viewing splunkd.log and searching for email error messages.
Bye.
Giuseppe

0 Karma

jenojasko
New Member

Hi Giuseppe,

there is no attachment in the email. Only text in the body. Also I don't have splunk installed, only using the browser version.

Regards,
Jeno

0 Karma

gcusello
Legend

Hi jenojasko,,
usually the problem is on attachments, verify that you don't exceed email body limits.

See in splunkd.log (directly on file or using Splunk search index=_internal sourcetype=splunkd) if there are email errors or warnings, this could guide you in error debugging.

Bye.
Giuseppe

0 Karma

jenojasko
New Member

Hi Giuseppe,

Thanks for your assist, tried it and there were no sign of any error, but the emails are still not sending sadly. Also every email has the same body without any attachment.

Thanks,
Jeno

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!