Message Size Exceeds error while sending email

[bsantosh]

Hi, some of the alerts are getting this "ERROR:root:(552, '5.3.4 Message size exceeds fixed maximum message size'"
and unable to sent out email.

How to solve this issue as I am unable to receive few of the alerts.

thanks,
Santosh

[mlevsh]

@bsantosh
Were you able to find out the cause of the issue?

[bsantosh]

I tried sending a test email from Splunk server to test email address that had issue and it is being sent properly. I will check with the email team.,Thanks. I sent a test email to the test email address and is being sent properly without any error.

[bsantosh]

Thanks for the reply. I have unchecked all the checkboxes from the Include field under the Send email option of the alert.
Unchecked "Link to Alert", "Link to Results", "Search String", "Inline","Trigger Condition","Attach CSV","Trigger Time","Attach PDF". But, still the email is not being received by a certain email alias group.
For testing purpose, I sent to a different email alias group and the mail is receiving. So, I am a little bit confused on whether the issue is in Splunk side or on email side.

[bsantosh]

Adding to that, even the email results are very less. Around 10-15 results for each alert email.

[cpetterborg]

It sounds like an email system problem. Have you tried simply emailing from that Splunk server to see if the email goes properly to the test email address that is having the problem?

[cpetterborg]

If you are sending the search results in the alert, then it is probably that the results are too big. Either don't send the results, or don't send all the results (you can do that using head or tail usually).

If that is not the case, then look to see what other attachments you are sending in the email.