05-29-2015 07:53:02.696 -0700 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+sourcetype%3Dt2_app+OR+sourcetype%3Ddis+iview2+%22%3Fdoc%3D%22+OR+%22%26doc%3D%22+%7C++timechart+span%3D1h+count+by+host+%7C+sendemail+to%3D%22tyrone.vaughn%40transcentra.com%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1432911162651 sent a 0 byte response after earlier claiming a Content-Length of 2160!
=============
This was working until recently. No changes that I am aware of on the machine or the environment, but I can't send email out any more. Above is the log entry when I execute that search from the interface. The interfaces responds with No connection could be made because the target machine actively refused it while sending mail to: (my email address)
.
I can send email from Powershell using:
$EmailFrom = "(source address)"
$EmailTo = "(my address, same as above)"
$Subject = "Test from CLI"
$Body = "Testing.. 1 2 3"
$SMTPServer = "(my relay, same one in Splunk config)
$SMTPClient = New-Object Net.Mail.SmtpClient($SMTPServer, 25)
$SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)
So I don't think it is a machine issue.
Do a test alert email preview from the UI, and check your splunkd.log
"test alert email preview" Could you explain that to me?
I did do an attempted send via "sendemail" from the search line and received the same errors.
Not sure what version you are using in Splunk, but in any case, just look in the $SPLUNK_HOME/var/log/splunk/splunkd.log for clues.
See above. I included a splunkd.log output.