All Apps and Add-ons

alert

shakti
Loves-to-Learn Everything

Hello,

I am not getting emails regarding the alerts I have setup in splunk ...Can anyone please help?

Labels (2)
0 Karma

marnall
Builder

Do you find any error logs if you search the _internal logs for "Sendemail"? (note the e, as in "send email" -> "sendemail", not "sendmail"                                           )

index=_internal sendemail NOT sourcetype=splunkd_ui_access

 

If you get a lot of random messages, try filtering the source for python and splunkd:

index=_internal sendemail NOT sourcetype=splunkd_ui_access source IN ("/opt/splunk/var/log/splunk/python.log","/opt/splunk/var/log/splunk/splunkd.log")

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shakti ,

did you configured the email relay in [Settings > Server Settings > Email Settings] ?

did you open all the routes between the Search Head and the eMail host?

You can troubleshoot the connection searching in _internal the word "Sendmail".

Ciao.

Giuseppe

0 Karma

shakti
Loves-to-Learn Everything

Thank you for your reply ...

 

The email settings are fine  and in internal logs I don't see any error related to "sendemail"...Could you please suggest what else could be done?

0 Karma

shakti
Loves-to-Learn Everything

@marnall   after using your query I am  getting error message as " connection refused" in my search results..

Should I change my localhost to something else in the mail server hostname in email settings in splunk UI ?Please do let me know

0 Karma

marnall
Builder

"Connection refused" typically indicates that the target server is not listening on the target port. This would make sense if your splunk server is using "localhost" as the mail server hostname and you are not running an email server on your Splunk machine.

If you would like to use an external mail server, then yes you should change the mail server hostname in email settings to match the external mail server.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...