We are on Splunk Enterprise 6.2.1
Logged in as a Splunk "user" with default privileges I am able to schedule Splunk Reports or Alerts and successfully send email results. For Dashboards I am able to Schedule PDF and enter "Email To", but the email never goes out. Splunk admin shows messages like this in the index=_internal source=python.log:
2016-01-26 13:45:05,776 -0800 ERROR sendemail:348 - (550, 'Unauthenticated senders not allowed', email@example.com') while sending mail to: firstname.lastname@example.org , email@example.com
The 'Unauthenticated senders not allowed' error message wording may be from sendgrid, our mail host.
If I log in as the Splunk "admin" and schedule the dashboard PDF email, the email goes out fine.
Is there a special "capability" that allows dashboard PDF email to be sent? I don't see anything obvious in the list in Access controls / Roles.
That's it, thank you.
Too bad the Splunk Scheulde Dashboard PDF UI doesn't let me know my email will fail. Also curious why sending report email and sending dashboard PDF do not have the same capability rules. But working now so I am happy.