index=cisco_asa src_ip!=10.* src_ip!=172.* src_ip!=192.* action=allowed | stats count by src_ip,dest_ip,dest_port | head 10 | sendemail to="splunk.mtlk@gmail.com" content_type=html subject=myresults sendresults=true inline=true sendpdf=true server="smtp.gmail.com:587" use_tls=true
I'm executing this query but getting error command="sendemail", (535, '5.7.3 Authentication unsuccessful') while sending mail to: splunk.mtlk@gmail.com
Under Server --> Email configuration: (local\alert_actions.conf)
[email]
auth_password = ******
auth_username = splunk.mtlk@gmail.com
mailserver = smtp.gmail.com:587
pdf.header_left = none
pdf.header_right = pagination
use_ssl = 0
use_tls = 1
from = Splunk Administrator
sslVersions = *
options tried: "ssl3", "tls1.0", "tls1.1", and "tls1.2".
* The special version "*" selects all supported versions. The version "tls"
selects all versions tls1.0 or newer.
Reference: https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Alertactionsconf
But SPL works when I execute
index=cisco_asa src_ip!=10.* src_ip!=172.* src_ip!=192.* action=allowed | stats count by src_ip,dest_ip,dest_port | head 10 | sendemail to="splunk.mtlk@gmail.com" content_type=html subject=myresults sendresults=true inline=true sendpdf=true server="smtp.gmail.com:25"
Under Server --> Email configuration: (local\alert_actions.conf)
[email]
auth_password = ******
auth_username = splunk.mtlk@gmail.com
mailserver = smtp.gmail.com
pdf.header_left = none
pdf.header_right = pagination
use_ssl = 0
use_tls = 1
But in both email configuration type; the scheduled alert is not working and don't get mails whereas the report is available to download in the Searches, reports, and alerts.
Note: I'm replacing company domain with gmail. I'm using "sendmail" to test alert.manually
