Need help with configuration for email alert

[bella]

I need some help to check configure send email, and I still have not received the email alert in my mailbox. The alert is already triggered as I can see that in the "triggered alerts" section.
when i configure like this,and saved.

then i open again, username,passward is gone,

[gcusello]

Hi @bella,

I suppose that you already checked that the route between your Search Head and eMail, if not, make it.

Anyway, I cannot completely understand your screenshot because I see Japanese chars, anyway, the first step is to check the eMail parameters: 

• url,
• port,
• TLS,
• user needed or not,
• eventually user and password.

Then check if the message and the attachment is big.

At least, you can see the Splunk logs in %SPLUNK_HOME/var/log/splunk/splunkd.log or in _internal index, searching mail errors.

Ciao.

Giuseppe

[bella]

i can see some error ,like this:

[gcusello]

Hi @bella,

the message says that there's an error in sendmail.

What about the other checks?

Ciao.

Giuseppe

[bella]

i find the configuration,like this:

[gcusello]

Hi @bella,

did you checked these parameters are the correct ones for your eMail system?

what about routes? usually this is the first problem.

Ciao.

Giuseppe

[bella]

Hi,

I've tested it. The SMTP account is OK. Now I'm a little confused

[gcusello]

hi @bella,

did you tried the connection (using telnet) from the Splunk server to the eMail server on the used port?

Ciao.

Giuseppe

[bella]

Hi,@gcusello

I changed the version of splunk from 8.0.6 to 8.2.5, before i test in  version 8.0.6,they all fail, when i test in  version 8.2.5,it is success.

thank you !

bella

[gcusello]

Hi @bella,

good for you, please accept one answer for the other people of Community, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[bella]

Hi，@gcusello,
I test many times:
smtp.qiye.aliyun:25
null
username:null
password:null

OR

smtp.qiye.aliyun:465
SSL
username:xxxxx@vskysoft.com
password:xxxyyyy
password confirm:xxxyyyy

they all false.
when i configure username,password, saved. then i open again, username,password all gone.
like i first screenshot; I really don't understand why I can't save my configuration. where i can see my configuration in config?