Splunk Email alerts

[Irosha]

Hi Experts,

I have configured email alerts on my splunk server. when i run the sendemail command;

Eg:
index=syslog | head 5 | sendemail to="Test.User@Test.local" server="smtp.test.local" subject="Here is an email notification" message="This is an example message"

I am getting below error message

command="sendemail", (421, '4.3.2 Service not available') while sending mail to: Test.User@Test.local

Any idea what might causing this issue ?

[dgrubb_splunk · Accepted solution]

With Email, sometimes it is just easier to attempt to deliver a message using telnet from the command line of the server to see what is the issue with email server.

Here is great technet article that describes the smtp commands:

https://technet.microsoft.com/en-us/library/aa995718%28v=exchg.65%29.aspx

If you get the same error response you can eliminate Splunk from the issue, and focus on the mail server, from address, to address etc as being the issue.

[Irosha]

there was an access list configured on our SMTP server. that was the issue. many thanks for the help.

[Irosha]

This is the search command i am trying to run;

index=syslog | head 5 | sendemail to=Test.User@Test.local server=smtp.test.local subject="Here is an email notification" message="This is an example message"

[richgalloway]

Have you looked at splunkd.log?