Why am I not getting Splunk Alerts in my mail ID?

[mailmetoramu]

Hi All,

I have configured real time in my trial Splunk environment & the rule got fired in the triggered results.

But the problem is that I have configured the alert to my mail ID, but I m not getting any emails regarding the alerts.

Please, can anyone let me know what may be the issue?

Thanks,

Ramu.R

[woodcock · Accepted solution]

Probably you have not configured your mail server settings correctly on the Search Head (found in Settings -> Server settings -> Email settings). If you have, test them manually with a command like this:

index=_* | head 1 | sendemail to="elvis@splunk.com" subject="test"

If that works, so should your alert. If not, start debugging.

[mailmetoramu]

I m getting the below error while executing the above command :
'command="sendemail", [Errno 11001] getaddrinfo failed while sending mail to: elvis@splunk.com

Can anyone please let me know what exactly need to configure under mail settings in step by step procedure.

[woodcock]

Do not useelvis@splunk.com; use your own email address that you know is valid. Then see if you get the email.

[mailmetoramu]

Tried even my e-mail ID, getting the same error ..!!

[elliotproebstel]

Have you already configured your mail settings in Splunk? If not, this guide will help you do that:
http://docs.splunk.com/Documentation/Splunk/7.0.3/Alert/Emailnotification

Have you been able to receive emails already from this Splunk instance - for other alerts, maybe? If this is the first time, I'd recommend taking a close look at those mail settings. You can also look at your internal logs for records of Splunk attempting to send emails:

index=_internal sendemail