Reporting

Sendemail action not working

elllie
New Member

Hello,

I have scheduled a search to run every 15 mins and added the following actions when the search returns results:
- Add to triggered alerts;
- Send email.

When the scheduled search returns results, it gets added to the Triggered Alerts but the sendemail action does not work.
When looking at the python.log it shows the following:
2018-03-15 11:51:06,163 +0100 INFO sendemail:134 - Sending email. subject="Splunk Alert: Multiple Failed logon attempts alert", results_link=splunk_scheduled_search", recipients="[u'user@mail.com']", server="smtp.mail.com"

It appears that when I include the sendemail command in the query, it works fine, but not through the scheduled alerts.

Any ideas why?

0 Karma

p_gurav
Champion

Hi,

Can you try increasing value for below parameter in alert_actions.conf:

ttl     = <integer>[p]
* Optional argument specifying the minimum time to live (in seconds)
  of the search artifacts, if this action is triggered.
* If p follows integer, then integer is the number of scheduled periods.
* If no actions are triggered, the artifacts will have their ttl determined
  by the "dispatch.ttl" attribute in savedsearches.conf.
* Defaults to 10p
* Defaults to 86400 (24 hours)   for: email, rss
* Defaults to   600 (10 minutes) for: script
* Defaults to   120 (2 minutes)  for: summary_index, populate_lookup

maxtime = <integer>[m|s|h|d]
* The maximum amount of time that the execution of an action is allowed to
  take before the action is aborted.
* Use the d, h, m and s suffixes to define the period of time:
  d = day, h = hour, m = minute and s = second.
  For example: 5d means 5 days.
* Defaults to 5m for everything except rss.
* Defaults to 1m for rss.
0 Karma

p_gurav
Champion

Any other error in _internal logs?

0 Karma

elllie
New Member

From scheduler.log:
03-15-2018 10:53:02.185 +0000 INFO SavedSplunker - savedsearch_id="nobody;search;Multiple Failed logon attempts alert", search_type="scheduled", user="admin", app="search", savedsearch_name="Multiple Failed logon attempts alert", priority=default, status=success, digest_mode=1, scheduled_time=1521110880, window_time=0, dispatch_time=1521110880, run_time=0.203, result_count=2, alert_actions="email", sid="scheduler_adminsearch_RMD5cf1e87219f408a1a_at_1521110880_14", suppressed=0, thread_id="AlertNotifierWorker-1"

splunkd.log:
03-15-2018 10:53:01.642 +0000 WARN ScriptRunner - Killing script, probably timed out, grace=5sec, script="C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py "results_link=http://SOUTH-SEC-01:8000/app/search/@go?sid=scheduler__admin__search__RMD5cf1e87219f408a1a_at_152111..." "ssname=Multiple Failed logon attempts alert" "graceful=True" "trigger_time=1521110881" results_file="C:\Program Files\Splunk\var\run\splunk\dispatch\scheduler_adminsearch_RMD5cf1e87219f408a1a_at_1521110880_14\results.csv.gz""

03-15-2018 10:53:02.185 +0000 ERROR script - sid:scheduler_adminsearch_RMD5cf1e87219f408a1a_at_1521110880_14 Script execution failed for external search command 'sendemail'

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...