Reporting

ERROR:root:(552, '5.3.4 Message size exceeds fixed limit'...) while sending mail

Builder

Hi,
Sometimes we are getting the following error while running reports and sending alerts by email when alert is triggered:

ERROR ScriptRunner - stderr from '/export/opt/splunk/bin/python /export/opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://splunkderver:8443/app/splunk_iseca/@go?sid=scheduler__username_c3BsdW5rX2lzZWNh" "ssname=Alert name" "graceful=True" "trigger_time=1539637210" results_file="/export/opt/splunk/var/run/splunk/dispatch/scheduler__username_c3BsdW5rX2lzZWNh/results.csv.gz"':  ERROR:root:(552, '5.3.4 Message size exceeds fixed limit', u'splunk@splunkserver') while sending mail to: firstname.lastname@ourdomain.com

1) Contacted our messaging admins. They mentioned 20MB limit on attachment.
Size of our attachments is much less. it is about 28K.
They also checked if there were any attempts to receive the emails we had issues with - no indications of them at all.

Any advice in which direction should we troubleshoot?

0 Karma
1 Solution

Builder

We figured it out. The search for the alert produced result with about 5000 events. Users checked to add results to email on alert as csv file and also "inline". Un-checking "inline" solved the issue.

View solution in original post

0 Karma

Builder

We figured it out. The search for the alert produced result with about 5000 events. Users checked to add results to email on alert as csv file and also "inline". Un-checking "inline" solved the issue.

View solution in original post

0 Karma