Reporting

How to troubleshoot why emails are not getting sent for some reports on the search head?

lukasz92
Communicator

Hi,

I have a problem on the search head - on some reports, emails are not sent

In _internal I see events:

SavedSplunker - alert_actions="email", sid="...", suppressed=0, thread_id="AlertNotifierWorker-0"

However, I do not see events:

sendemail:112 - Sending email. subject="Splunk Report: (...(", results_link="https://splunk-pci.(...)/app/search/@go?sid=(...)", recipients="[u'(...)']", server="smtp01-pci"

How to diagnose this problem?

0 Karma

gcusello
Legend

Hi lukasz92,
have you search results are in your eMail body or in attach?
verify the dimensions of your eMail and (eventually) your attachment because sometimes the problem is that eMail body or email attachment exceed the limits of your eMail server.
You can verify this triggering an alert without inserting results in the eMail body and without attaching them to the eMail.
In addition you can see Splunk logs in $SPLUNK_HOME/var/log/splunk/splunkd.log.
Bye.
Giuseppe

0 Karma

rjthibod
Champion

Look in splunkd.log in /var/log for more information and use the sendmail SPL command to test out configuration changes.

0 Karma

lukasz92
Communicator

What do you mean?

sendmail works correctly, some reports send mail.
What should I search more?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

How many Email servers do you have in your DNS entry, you can check via nslookup command with your sendmail server name.

I faced same issue when there was problem with one of the email server. I have 4 email servers IP when I check using nslookup <email server name> and on DNS, round-robin method defined to handle traffic on all 4 email servers so when request goes to faulty email server, I didn't get email but when next email will be fired by splunk it goes to next email server which is working fine so I received email.

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...