I've been trying to get my splunk instance to send out email alerts using Amazon SES SMTP server without much luck.
The error in my python.log file seems to suggest that it is not collecting the correct server I have configured under
Server settings ->
Email settings - or
The error being:
ERROR sendemail:142 - Sending email. ... server="localhost"
ERROR sendemail:473 - [Errno 111] Connection refused while sending mail to: email@example.com
oddly enough, it gathers
firstname.lastname@example.org just fine as defined in my alert definition.
I've seen other posts on here suggesting that values in
savedsearches.conf can override the
action.email.mailserver configuration, but I see no such file in my
local config directory or any other suggestion of a conflict for
you can check with btool if some app override the setting by unsetting the value:
/opt/splunk/bin/splunk btool savesearches list --debug|grep mailserver /opt/splunk/bin/splunk btool alert_actions list --debug|grep mailserver
action.email.mailserver = <string> * Set the address of the MTA server to be used to send the emails. * Defaults to <LOCALHOST> (or the 'mailserver' setting in alert_actions.conf file)
mailserver = <host>[:<port>] * You must have a Simple Mail Transfer Protocol (SMTP) server available to send email. This is not included with Splunk. * Specifies the SMTP mail server to use when sending emails. * <host> can be either the hostname or the IP address. * Optionally, specify the SMTP <port> that Splunk should connect to. * When the 'use_ssl' setting (see below) is set to 1 (true), you must specify both <host> and <port>. (Example: "example.com:465") * Default: $LOCALHOST:25
Hey, thanks for the response!
running these both gave me
/opt/splunk/bin/splunkd: error while loading shared libraries: libjemalloc.so.2: cannot open shared object file: No such file or directory
EDIT: Disregard, misread the commands you provided. no results for the first command, the second command spits out the correct smtp server that I'm expecting. No overwrites.