Getting Data In

email not sending from windows search head

tyronetv
Communicator

From splunkd.log

05-29-2015 07:53:02.696 -0700 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+sourcetype%3Dt2_app+OR+sourcetype%3Ddis+iview2+%22%3Fdoc%3D%22+OR+%22%26doc%3D%22+%7C++timechart+span%3D1h+count+by+host+%7C+sendemail+to%3D%22tyrone.vaughn%40transcentra.com%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1432911162651 sent a 0 byte response after earlier claiming a Content-Length of 2160!

=============
This was working until recently. No changes that I am aware of on the machine or the environment, but I can't send email out any more. Above is the log entry when I execute that search from the interface. The interfaces responds with No connection could be made because the target machine actively refused it while sending mail to: (my email address).

I can send email from Powershell using:

 $EmailFrom = "(source address)"
 $EmailTo = "(my address, same as above)"
 $Subject = "Test from CLI"
 $Body = "Testing.. 1 2 3"
 $SMTPServer = "(my relay, same one in Splunk config)
 $SMTPClient =  New-Object Net.Mail.SmtpClient($SMTPServer, 25)
 $SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)

So I don't think it is a machine issue.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Do a test alert email preview from the UI, and check your splunkd.log

0 Karma

tyronetv
Communicator

"test alert email preview" Could you explain that to me?

I did do an attempted send via "sendemail" from the search line and received the same errors.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Not sure what version you are using in Splunk, but in any case, just look in the $SPLUNK_HOME/var/log/splunk/splunkd.log for clues.

0 Karma

tyronetv
Communicator

See above. I included a splunkd.log output.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...