Why did email alerts stop sending after upgrading to Splunk 6.1?


After upgrading to 6.1, our email alerts have stopped sending.

In the splunkd.log I'm getting the following line

01-13-2015 07:25:06.258 -0500 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\ "results_link=" "ssname=Alert: Error Message from Windows Application Event Log" "graceful=True" "trigger_time=1421151905" results_file="C:\\Program Files\\Splunk\\var\\run\\splunk\\dispatch\\scheduler__admin__search__RMD50a13d0b190b0c032_at_1421151900_1351\\results.csv.gz"':  ERROR:root:missing required argument: to. Please specify at least on email recipient as: ""

I've tried putting the email info in the Alerts Search string, and emails are sent, however the alerts are triggered on a Cron schedule every 5 mins, so each alert sends an email every 5 mins whether there's anything to report or not.

I've also tried replacing and with those below and restarting Splunk....

Am still getting the same error in the log.

Can anyone help with this?


Re: Why did email alerts stop sending after upgrading to Splunk 6.1?


To update everyone on what the solution was for us.

During the upgrade from 5 to 6.1 the wasn't upgraded.

The from the github link above wasn't the incorrect one therefore didn't fix it.

I did a stand alone fresh install of v6.1.4 to my laptop, grabbed the from there and copied it to our Splunk server.

Emails are now sending.

View solution in original post