I have configured real time in my trial Splunk environment & the rule got fired in the triggered results.
But the problem is that I have configured the alert to my mail ID, but I m not getting any emails regarding the alerts.
Please, can anyone let me know what may be the issue?
Have you already configured your mail settings in Splunk? If not, this guide will help you do that:
Have you been able to receive emails already from this Splunk instance - for other alerts, maybe? If this is the first time, I'd recommend taking a close look at those mail settings. You can also look at your internal logs for records of Splunk attempting to send emails:
Probably you have not configured your mail server settings correctly on the Search Head (found in
Server settings ->
Email settings). If you have, test them manually with a command like this:
index=_* | head 1 | sendemail to="firstname.lastname@example.org" subject="test"
If that works, so should your alert. If not, start debugging.
I m getting the below error while executing the above command :
'command="sendemail", [Errno 11001] getaddrinfo failed while sending mail to: email@example.com
Can anyone please let me know what exactly need to configure under mail settings in step by step procedure.
Do not use
firstname.lastname@example.org; use your own email address that you know is valid. Then see if you get the email.