Splunk Dev

Sendemail using Python SDK

sunilsk1
Path Finder

I am trying to run the following search using Splunk python sdk. It returns the results but does not send the EMAIL as it does if i run the same search using the Splunk UI.

searchquery_normal = 'search * earliest="8/26/2013:23:40:00"  latest="8/26/2013:23:55:00" index=os  host=* sourcetype=cpu | lookup chipot fqdn as host | search application_name="New App*" AND physical_environment_name="Production*" AND state="LIVE"| multikv fields pctUser,pctSystem,pctIowait,pctIdle,application_name | search all |eval cpu=100-pctIdle|stats avg(cpu) by host,application_name|rename avg(cpu) as cpualert|where cpualert >20|sort "application_name"|sendemail to="myemailid@domain.com" format=html subject=ALERT_CPU_sentfromPython  sendresults=true'
0 Karma

jkat54
SplunkTrust
SplunkTrust

What app context are you executing the search with in both scenarios? Alert_actions.conf can be app specific so that one app uses one mail server and settings yet another app can use a different mail server and settings.

So if you have your email configured via alert_actions in yourAppName but you’re executing search from servicesNS/-/- or etc... this could be the cause for the descrepancy.

0 Karma
Get Updates on the Splunk Community!

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...