I have a problem on the search head - on some reports, emails are not sent
In _internal I see events:
SavedSplunker - alert_actions="email", sid="...", suppressed=0, thread_id="AlertNotifierWorker-0"
However, I do not see events:
sendemail:112 - Sending email. subject="Splunk Report: (...(", results_link="https://splunk-pci.(...)/app/search/@go?sid=(...)", recipients="[u'(...)']", server="smtp01-pci"
How to diagnose this problem?
have you search results are in your eMail body or in attach?
verify the dimensions of your eMail and (eventually) your attachment because sometimes the problem is that eMail body or email attachment exceed the limits of your eMail server.
You can verify this triggering an alert without inserting results in the eMail body and without attaching them to the eMail.
In addition you can see Splunk logs in $SPLUNK_HOME/var/log/splunk/splunkd.log.
How many Email servers do you have in your DNS entry, you can check via nslookup command with your sendmail server name.
I faced same issue when there was problem with one of the email server. I have 4 email servers IP when I check using
nslookup <email server name> and on DNS, round-robin method defined to handle traffic on all 4 email servers so when request goes to faulty email server, I didn't get email but when next email will be fired by splunk it goes to next email server which is working fine so I received email.