Email notifications for alerts are not working

[jenojasko]

I've saved a search and set up an alert to run the search every 10 minutes and send out email notification if the number of result is greater then 0, it was working fine at the start (about 5 months ago) after some time it only sent out the email 7 out of 10 times and for the last 2 days I haven't got any email but I can see that the alert was triggered a couple of times in the trigger history. What could be causing this issue? (Splunk 6.3)

Thanks,
Jeno

[gcusello]

Hi jenojasko,
in your alert is there an attachement? if there is an attachement verify if it exceeds you email limits: test if your alert runs without attachements.
You can verify this also viewing splunkd.log and searching for email error messages.
Bye.
Giuseppe

[jenojasko]

Hi Giuseppe,

there is no attachment in the email. Only text in the body. Also I don't have splunk installed, only using the browser version.

Regards,
Jeno

[gcusello]

Hi jenojasko,,
usually the problem is on attachments, verify that you don't exceed email body limits.

See in splunkd.log (directly on file or using Splunk search index=_internal sourcetype=splunkd) if there are email errors or warnings, this could guide you in error debugging.

Bye.
Giuseppe

[jenojasko]

Hi Giuseppe,

Thanks for your assist, tried it and there were no sign of any error, but the emails are still not sending sadly. Also every email has the same body without any attachment.

Thanks,
Jeno