Sendemail not working

[khilanm]

• I have configured email settings as below

1. smtp.gmail.com:587 with TLS selected
2. username - email
3. password

• Search queries I have tried as below:

1) index=_internal | head 5 | sendemail to="<myemail>" server=smtp.gmail.com subject="Here is an email from Splunk" message="This is an example message" sendresults=true

2) index=_internal
| head 5
| sendemail to="<myemail>" server=smtp.gmail.com:587 subject="Here is an email from Splunk" message="This is an example message" sendresults=true

• ERROR: command="sendemail", (530, b'5.7.0 Authentication Required. Learn more at\n5.7.0 https://support.google.com/mail/?p=WantAuthError - gsmtp',

3)index=_internal
| head 5
| sendemail to="<myemail>" server=smtp.gmail.com:587 use_tls=1 subject="Here is an email from Splunk" message="This is an example message" sendresults=true

4)index=_internal
| head 5
| sendemail to="<myemail>" subject="Here is an email from Splunk" message="This is an example message" sendresults=true

• ERROR: command="sendemail", (534, b'5.7.9 Application-specific password required. Learn more at\n5.7.9 https://support.google.com/mail/?p=InvalidSecondFactor - gsmtp')

• I have also tried after disabling less secure access apps.
• Search Query is not even trying to log in I think.

Any help is appreciated thanks.

[00willo]

I also got the "Application-specific password required" error when attempting to use my gmail as my email server.

As I had 2nd factor turned on, I found that I needed to set a separate app-specific password. After discovering this existed, this is how I'd want to do it anyway, even without being forced to. That way, I don't have to put my password that I use day to day for google into the splunk settings.

You can set an app password via https://myaccount.google.com/apppasswords

Here is the help if you need further information. https://support.google.com/accounts/answer/185833?hl=en