Sometimes we are getting the following error while running reports and sending alerts by email when alert is triggered:
ERROR ScriptRunner - stderr from '/export/opt/splunk/bin/python /export/opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://splunkderver:8443/app/splunk_iseca/@go?sid=scheduler__username_c3BsdW5rX2lzZWNh" "ssname=Alert name" "graceful=True" "trigger_time=1539637210" results_file="/export/opt/splunk/var/run/splunk/dispatch/scheduler__username_c3BsdW5rX2lzZWNh/results.csv.gz"': ERROR:root:(552, '5.3.4 Message size exceeds fixed limit', u'splunk@splunkserver') while sending mail to: email@example.com
1) Contacted our messaging admins. They mentioned 20MB limit on attachment.
Size of our attachments is much less. it is about 28K.
They also checked if there were any attempts to receive the emails we had issues with - no indications of them at all.
Any advice in which direction should we troubleshoot?