Setting up an alert in splunk to notify user when SMTP server is stuck

New Member

I want to setup an alert whenever SMTP server is stuck/hung i.e. when smtp is not sending alerts.

My SMTP server gets stuck certain time and wont be sending any emails until we restart the server.

so I want to setup an alert in splunk to notify me when the SMTP server is stuck.

P.S when the SMTP server is stuck no logs are generated so there is no such specific error messages.

so let me know if there is any way to setup an alert.


Labels (2)
0 Karma


how about :

index=smtpindex sourcetype=smtpsourcetype earliest=-10m
| stats count 
| search count=0

Save that as an alert
set "Trigger alert when" "Number of events" > 0.

Add a schedule to the alert
and add some action (ie send an email)
and you're done.

Hope this helps...


0 Karma

New Member

SMTP server is not in my splunk environment,it is present some other teams environment.

so" index=smtpindex sourcetype=smtpsourcetype" I wont be able to give this index and sourcetype as I have not created any index as smtpindex

correct me if I am wrong

0 Karma


If the system isn't splunked, do you have a forwarder that is able to ping it?

Could try a scripted input by writing a simple sh or powershell script, which pings the device to see if it's online?

0 Karma

New Member

yes I have forwader which monitors the SMTP system

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...