Unable to send test email from Splunk

[mukeshprasad4u]

I am trying configuring gmail smtp but when sending test email using below command getting below error. 

Any help will be appreciated. 

Command:

index=_internal | head 1 | sendemail to="[email protected]" format="html" server=smtp.gmail.com:587 use_tls=1

command="sendemail", (530, b'5.7.0 Authentication Required. Learn more at\n5.7.0 https://support.google.com/mail/?p=WantAuthError w22-20020a1709027b9600b0019a593e45f1sm196622pll.261 - gsmtp', '[email protected]') while sending mail to: @[email protected]

[dimmitrisd]

The following procedure worked for me fine. I created a mini guide:

1. Setting Up Google SMTP in Splunk To successfully send emails from Splunk via Gmail, you must use an App Password rather than your regular account password.

Generate App Password: Go to your Google Account settings, enable 2-Step Verification, and generate a 16-character App Password.

Configure Splunk Email Settings: Navigate to Settings > System settings > Email alert settings. Mail host: smtp.gmail.com:465. Email security: SSL. Username: Your full Gmail address. Password: Paste the 16-character (without spaces) App Password here. Click Save.

2. How to Trigger/Test the Alert You can verify your configuration by running a manual test command in the search bar. This confirms your SMTP settings are correct without needing to wait for a real event.

Run Test Command: Use the following command in the Splunk Search bar: index=_internal | head 1 | sendemail to="[email protected]" subject="Test Alert" message="Splunk SMTP is working" sendresults=true format=table sendcsv=false.

Expected Outcome: If the configuration is correct, you will receive a test email, and the search will display "The search completed successfully". 3. Setting Up an Automated Alert

Once testing is successful, configure an automated trigger for new events: Create Alert: Perform a search for your specific event (e.g., index="your_index"). Save as Alert: Click Save As > Alert. Schedule: Set the Alert type to Scheduled. Frequency: To check every minute, select Run on Cron Schedule and enter */1 * * * *. Time Range: Set the time range to "Last 1 minute" to ensure the alert only triggers for new events within that specific window. Trigger Condition: Set Number of results to is greater than 0. Add Action: Select Add Actions > Send email and enter the recipient address. Important Note: These steps apply to the Enterprise/Trial version. Please be aware that the Free version of Splunk has limitations that prevent these email alert actions from working.

[marioespbaires]

Hello,

by any chance, did you find a solution for this? I got the same issue right now.

[isoutamo]

Hi

Currently gmail don't allow use smtp server as earlier. Instead it wants to use more secure authentication. For that reason the old way is not working anymore with Splunk. Fortunately they have implemented 2-factor authentication and additional app password feature which you could use.

Here is steps to do it

1. https://support.google.com/accounts/answer/185833?sjid=13755993998155727325-EU#:~:text=to%2520your%2...
   
   1. Check above instructions and ensure that you have 2-step verification on (probably this is as Google has enabled it for all)
   2. Create a new app password for your Splunk server
   3. Login to your local splunk instance
      1. Settings -> Server settings
      2. Email settings
         1. Mail host: smtp.gmail.com:587
         2. Email security: Enable TLS
         3. Username: Your Gmail account where you have enabled 2 Step verification
         4. Password: App password for above Gmail account
         5. Allowed Domains: <add what is needed>
         6. Save
      3. Go to search GUI:

index=_internal
| head 1
| sendemail to="<your test email recipient>" subject=test sendresults=true format=table sendcsv=false

r. Ismo