Getting Data In

email not sending from windows search head

tyronetv
Communicator

From splunkd.log

05-29-2015 07:53:02.696 -0700 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+sourcetype%3Dt2_app+OR+sourcetype%3Ddis+iview2+%22%3Fdoc%3D%22+OR+%22%26doc%3D%22+%7C++timechart+span%3D1h+count+by+host+%7C+sendemail+to%3D%22tyrone.vaughn%40transcentra.com%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1432911162651 sent a 0 byte response after earlier claiming a Content-Length of 2160!

=============
This was working until recently. No changes that I am aware of on the machine or the environment, but I can't send email out any more. Above is the log entry when I execute that search from the interface. The interfaces responds with No connection could be made because the target machine actively refused it while sending mail to: (my email address).

I can send email from Powershell using:

 $EmailFrom = "(source address)"
 $EmailTo = "(my address, same as above)"
 $Subject = "Test from CLI"
 $Body = "Testing.. 1 2 3"
 $SMTPServer = "(my relay, same one in Splunk config)
 $SMTPClient =  New-Object Net.Mail.SmtpClient($SMTPServer, 25)
 $SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)

So I don't think it is a machine issue.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Do a test alert email preview from the UI, and check your splunkd.log

0 Karma

tyronetv
Communicator

"test alert email preview" Could you explain that to me?

I did do an attempted send via "sendemail" from the search line and received the same errors.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Not sure what version you are using in Splunk, but in any case, just look in the $SPLUNK_HOME/var/log/splunk/splunkd.log for clues.

0 Karma

tyronetv
Communicator

See above. I included a splunkd.log output.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...