alert

[shakti]

Hello,

I am not getting emails regarding the alerts I have setup in splunk ...Can anyone please help?

[marnall]

Do you find any error logs if you search the _internal logs for "Sendemail"? (note the e, as in "send email" -> "sendemail", not "sendmail"                                           )

index=_internal sendemail NOT sourcetype=splunkd_ui_access

If you get a lot of random messages, try filtering the source for python and splunkd:

index=_internal sendemail NOT sourcetype=splunkd_ui_access source IN ("/opt/splunk/var/log/splunk/python.log","/opt/splunk/var/log/splunk/splunkd.log")

[gcusello]

Hi @shakti ,

did you configured the email relay in [Settings > Server Settings > Email Settings] ?

did you open all the routes between the Search Head and the eMail host?

You can troubleshoot the connection searching in _internal the word "Sendmail".

Ciao.

Giuseppe

[shakti]

Thank you for your reply ...

The email settings are fine  and in internal logs I don't see any error related to "sendemail"...Could you please suggest what else could be done?

[shakti]

@marnall   after using your query I am  getting error message as " connection refused" in my search results..

Should I change my localhost to something else in the mail server hostname in email settings in splunk UI ?Please do let me know

[marnall]

"Connection refused" typically indicates that the target server is not listening on the target port. This would make sense if your splunk server is using "localhost" as the mail server hostname and you are not running an email server on your Splunk machine.

If you would like to use an external mail server, then yes you should change the mail server hostname in email settings to match the external mail server.