Alerting
Highlighted

Why is an email not being sent when my alert is triggered?

Engager

Hi

I created an alert that is triggered correctly, but the email is not sent by Splunk log i got error

[Errno 10060] A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond while sending mail to: user2@gmail.com

or sometimes

 [Errno 11004] getaddrinfo failed while sending mail to:user2@gmail.com 

My email settings in Server settings » Email settings

alert_action.conf

[email]
auth_password = password*****i
auth_username = user@gmail.com
mailserver = smtp.gmail.com:587
format = html
use_tls = 0      I changed this to 1 also, but email still wasn't sent
use_ssl = 0

My alert configuration is:
savedsearches.conf file

[request]
action.email = 1
action.email.priority = 2
action.email.reportServerEnabled = 0
action.email.to = user2@gmail.com
action.email.useNSSubject = 1
alert.severity = 4
alert.suppress = 1
alert.suppress.period = 30s
alert.track = 1
counttype = number of events
cron_schedule = */2 * * * *
description = resuest resive
dispatch.latest_time = now
display.events.fields = ["host","source","sourcetype","Msg"]
display.general.type = statistics
display.page.search.mode = verbose
display.page.search.tab = statistics
enableSched = 1
quantity = 1
relation = greater than
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index="newpwm" source="SOCK_20150327_192217.log" Msg=Q*| eval vv=substr(Msg, 7,8) | Table _time Msg vv

Please help me. For 1 day I've tried many times to use my company domain and port, but it's not working. I want an email sent only when the alert is triggered.

0 Karma
Highlighted

Re: Why is an email not being sent when my alert is triggered?

Motivator

Is your splunk instance is installed in the cloud? or locally?
If locally, check the external exchange server that you use to send emails.

0 Karma
Highlighted

Re: Why is an email not being sent when my alert is triggered?

Engager

localhost:8000

0 Karma
Highlighted

Re: Why is an email not being sent when my alert is triggered?

Engager

where i get this external exchange server sir and how i change this
please help me

0 Karma
Highlighted

Re: Why is an email not being sent when my alert is triggered?

Motivator

No, just to say you need to host your splunk instance before, Since you must be in the cloud to access to mail servers, which allow the email sending.

0 Karma
Highlighted

Re: Why is an email not being sent when my alert is triggered?

Builder

Hi,
if your splunk instance is installed locally, it can't send emails because emails are going from one server to anothers.
In spite you are connected to internet when you work on your local splunk instance, you are not on a server. So your splunk instance couldn't send email.
But if your splunk instance is on the cloud, it'll send emails correctly.

View solution in original post

Highlighted

Re: Why is an email not being sent when my alert is triggered?

Communicator

thanks for reply sir

0 Karma
Highlighted

Re: Why is an email not being sent when my alert is triggered?

Communicator

my company give new mailid is which authorize for sending mail so i use this they sent mail now

0 Karma
Highlighted

Re: Why is an email not being sent when my alert is triggered?

Community Manager
Community Manager

Hi @nitesh218ss

If your problem is solved, don't forget to accept @NOUMSSI's answer by clicking on "Accept" below their answer.

0 Karma