I am trying to setup email alerts and it looks like my first attempt failed:
index=_internal host="audemosplunk1" ( source="*splunkd.log" ) ( log_level="ERROR" ) * | cluster showcount=t | search _raw="06-09-2015 22:36:11.250 +0000 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python /opt/splunk/etc/apps/search/bin/sendemail.py \\\"results_link=http://audemosplunk1:8000/app/search/search?q=%7Cloadjob%20rt_scheduler__kpearce__search__Assert_at_1433883980_27706.1%20%7C%20head%201%20%7C%20tail%201&earliest=0&latest=now\\\" \\\"ssname=Assert\\\" \\\"graceful=True\\\" \\\"trigger_time=1433889370\\\" results_file=\\\"/opt/splunk/var/run/splunk/dispatch/rt_scheduler__kpearce__search__Assert_at_1433883980_27706.1/per_result_alert/tmp_0.csv.gz\\\"': ERROR:root:[Errno -2] Name or service not known while sending mail to: kevin.pearce@hypori.com"
Is there a master list someplace of what the Errno codes mean? I can't tell if I have done the email setup wrong (no test button?) or the alert wrong somehow.
Thoughts?
Hi kevinp512,
This is a simple Python error code which tells you that Splunk was not able to send the email. That could have many reasons, like firewall blocking, typo in the config or email recipient - do the usual troubleshooting, but more outside of Splunk.
To troubleshoot what happens inside of Splunk take a look at this answer http://answers.splunk.com/answers/141334/unable-to-trigger-alert-from-splunk-name-or-service-not-kno...
Hope this helps ...
cheers, MuS