I have scheduled a search to run every 15 mins and added the following actions when the search returns results:
- Add to triggered alerts;
- Send email.
When the scheduled search returns results, it gets added to the Triggered Alerts but the sendemail action does not work.
When looking at the python.log it shows the following:
2018-03-15 11:51:06,163 +0100 INFO sendemail:134 - Sending email. subject="Splunk Alert: Multiple Failed logon attempts alert", resultslink=splunkscheduled_search", recipients="[firstname.lastname@example.org']", server="smtp.mail.com"
It appears that when I include the sendemail command in the query, it works fine, but not through the scheduled alerts.
Any ideas why?
03-15-2018 10:53:02.185 +0000 INFO SavedSplunker - savedsearchid="nobody;search;Multiple Failed logon attempts alert", searchtype="scheduled", user="admin", app="search", savedsearchname="Multiple Failed logon attempts alert", priority=default, status=success, digestmode=1, scheduledtime=1521110880, windowtime=0, dispatchtime=1521110880, runtime=0.203, resultcount=2, alertactions="email", sid="scheduleradminsearch_RMD5cf1e87219f408a1aat152111088014", suppressed=0, thread_id="AlertNotifierWorker-1"
03-15-2018 10:53:01.642 +0000 WARN ScriptRunner - Killing script, probably timed out, grace=5sec, script="C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py "resultslink=http://SOUTH-SEC-01:8000/app/search/@go?sid=scheduleradminsearchRMD5cf1e87219f408a1aat152111088014" "ssname=Multiple Failed logon attempts alert" "graceful=True" "triggertime=1521110881" resultsfile="C:\Program Files\Splunk\var\run\splunk\dispatch\scheduleradminsearch_RMD5cf1e87219f408a1aat152111088014\results.csv.gz""
03-15-2018 10:53:02.185 +0000 ERROR script - sid:scheduleradminsearch_RMD5cf1e87219f408a1aat152111088014 Script execution failed for external search command 'sendemail'
Can you try increasing value for below parameter in
ttl = <integer>[p] * Optional argument specifying the minimum time to live (in seconds) of the search artifacts, if this action is triggered. * If p follows integer, then integer is the number of scheduled periods. * If no actions are triggered, the artifacts will have their ttl determined by the "dispatch.ttl" attribute in savedsearches.conf. * Defaults to 10p * Defaults to 86400 (24 hours) for: email, rss * Defaults to 600 (10 minutes) for: script * Defaults to 120 (2 minutes) for: summary_index, populate_lookup maxtime = <integer>[m|s|h|d] * The maximum amount of time that the execution of an action is allowed to take before the action is aborted. * Use the d, h, m and s suffixes to define the period of time: d = day, h = hour, m = minute and s = second. For example: 5d means 5 days. * Defaults to 5m for everything except rss. * Defaults to 1m for rss.