All Apps and Add-ons

alert

shakti
Loves-to-Learn Everything

Hello,

I am not getting emails regarding the alerts I have setup in splunk ...Can anyone please help?

Labels (2)
0 Karma

marnall
Builder

Do you find any error logs if you search the _internal logs for "Sendemail"? (note the e, as in "send email" -> "sendemail", not "sendmail"                                           )

index=_internal sendemail NOT sourcetype=splunkd_ui_access

 

If you get a lot of random messages, try filtering the source for python and splunkd:

index=_internal sendemail NOT sourcetype=splunkd_ui_access source IN ("/opt/splunk/var/log/splunk/python.log","/opt/splunk/var/log/splunk/splunkd.log")

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @shakti ,

did you configured the email relay in [Settings > Server Settings > Email Settings] ?

did you open all the routes between the Search Head and the eMail host?

You can troubleshoot the connection searching in _internal the word "Sendmail".

Ciao.

Giuseppe

0 Karma

shakti
Loves-to-Learn Everything

Thank you for your reply ...

 

The email settings are fine  and in internal logs I don't see any error related to "sendemail"...Could you please suggest what else could be done?

0 Karma

shakti
Loves-to-Learn Everything

@marnall   after using your query I am  getting error message as " connection refused" in my search results..

Should I change my localhost to something else in the mail server hostname in email settings in splunk UI ?Please do let me know

0 Karma

marnall
Builder

"Connection refused" typically indicates that the target server is not listening on the target port. This would make sense if your splunk server is using "localhost" as the mail server hostname and you are not running an email server on your Splunk machine.

If you would like to use an external mail server, then yes you should change the mail server hostname in email settings to match the external mail server.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...