Alerting

Why am I not getting Splunk Alerts in my mail ID?

mailmetoramu
Explorer

Hi All,

I have configured real time in my trial Splunk environment & the rule got fired in the triggered results.

But the problem is that I have configured the alert to my mail ID, but I m not getting any emails regarding the alerts.

Please, can anyone let me know what may be the issue?

Thanks,

Ramu.R

0 Karma
1 Solution

woodcock
Esteemed Legend

Probably you have not configured your mail server settings correctly on the Search Head (found in Settings -> Server settings -> Email settings). If you have, test them manually with a command like this:

index=_* | head 1 | sendemail to="elvis@splunk.com" subject="test"

If that works, so should your alert. If not, start debugging.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Probably you have not configured your mail server settings correctly on the Search Head (found in Settings -> Server settings -> Email settings). If you have, test them manually with a command like this:

index=_* | head 1 | sendemail to="elvis@splunk.com" subject="test"

If that works, so should your alert. If not, start debugging.

View solution in original post

0 Karma

mailmetoramu
Explorer

I m getting the below error while executing the above command :
'command="sendemail", [Errno 11001] getaddrinfo failed while sending mail to: elvis@splunk.com

Can anyone please let me know what exactly need to configure under mail settings in step by step procedure.

0 Karma

woodcock
Esteemed Legend

Do not useelvis@splunk.com; use your own email address that you know is valid. Then see if you get the email.

0 Karma

mailmetoramu
Explorer

Tried even my e-mail ID, getting the same error ..!!

0 Karma

elliotproebstel
Champion

Have you already configured your mail settings in Splunk? If not, this guide will help you do that:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Alert/Emailnotification

Have you been able to receive emails already from this Splunk instance - for other alerts, maybe? If this is the first time, I'd recommend taking a close look at those mail settings. You can also look at your internal logs for records of Splunk attempting to send emails:

index=_internal sendemail
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.