Reporting

ERROR:root:(552, '5.3.4 Message size exceeds fixed limit'...) while sending mail

mlevsh
Builder

Hi,
Sometimes we are getting the following error while running reports and sending alerts by email when alert is triggered:

ERROR ScriptRunner - stderr from '/export/opt/splunk/bin/python /export/opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://splunkderver:8443/app/splunk_iseca/@go?sid=scheduler__username_c3BsdW5rX2lzZWNh" "ssname=Alert name" "graceful=True" "trigger_time=1539637210" results_file="/export/opt/splunk/var/run/splunk/dispatch/scheduler__username_c3BsdW5rX2lzZWNh/results.csv.gz"':  ERROR:root:(552, '5.3.4 Message size exceeds fixed limit', u'splunk@splunkserver') while sending mail to: firstname.lastname@ourdomain.com

1) Contacted our messaging admins. They mentioned 20MB limit on attachment.
Size of our attachments is much less. it is about 28K.
They also checked if there were any attempts to receive the emails we had issues with - no indications of them at all.

Any advice in which direction should we troubleshoot?

0 Karma
1 Solution

mlevsh
Builder

We figured it out. The search for the alert produced result with about 5000 events. Users checked to add results to email on alert as csv file and also "inline". Un-checking "inline" solved the issue.

View solution in original post

0 Karma

mlevsh
Builder

We figured it out. The search for the alert produced result with about 5000 events. Users checked to add results to email on alert as csv file and also "inline". Un-checking "inline" solved the issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...