ERROR:root:(552, '5.3.4 Message size exceeds fixed limit'...) while sending mail

[mlevsh]

Hi,
Sometimes we are getting the following error while running reports and sending alerts by email when alert is triggered:

ERROR ScriptRunner - stderr from '/export/opt/splunk/bin/python /export/opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://splunkderver:8443/app/splunk_iseca/@go?sid=scheduler__username_c3BsdW5rX2lzZWNh" "ssname=Alert name" "graceful=True" "trigger_time=1539637210" results_file="/export/opt/splunk/var/run/splunk/dispatch/scheduler__username_c3BsdW5rX2lzZWNh/results.csv.gz"':  ERROR:root:(552, '5.3.4 Message size exceeds fixed limit', u'splunk@splunkserver') while sending mail to: firstname.lastname@ourdomain.com

1) Contacted our messaging admins. They mentioned 20MB limit on attachment.
Size of our attachments is much less. it is about 28K.
They also checked if there were any attempts to receive the emails we had issues with - no indications of them at all.

Any advice in which direction should we troubleshoot?

[mlevsh · Accepted solution]

We figured it out. The search for the alert produced result with about 5000 events. Users checked to add results to email on alert as csv file and also "inline". Un-checking "inline" solved the issue.