Why is Splunk alert not firing email?

[izzie123]

Hello,

I have set an alert which generates around 50-60 events everyday. I have configured this alert to send mails to my email id, I have been observing that not all events generate emails and the count of the alert events and the mails received mismatches.

The alert mail is not fired intermittently. Can you please suggest some ways to troubleshoot the cause of this problem?

Thanks in advance

[isoutamo]

Hi

you should look from _internal have those fired and if what has happened to them. You should also remember that email isn’t 100% sure delivery method.

Here are some links to this issue:

• https://community.splunk.com/t5/Reporting/Trigger-alert-not-seen-as-email-notification-for-some-even...
  
  
• https://community.splunk.com/t5/Alerting/Why-is-my-alert-not-triggering/m-p/376344
  
  

r. Ismo

[izzie123]

Thanks for your answer @isoutamo 
I checked the internal logs and found this error : 

ERROR:root:(421, b'4.4.2 Message submission rate for this client has exceeded the configured limit',")

[isoutamo]

Your splunk server has sent too many alert emails in short period so smtp server refused to accept more. Are you sure that you don’t sent own alert per event instead of one email per running the alert?