Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- What capabilities are needed to run sendemail comm...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello all,
Certain users in our environment seem to be able to run searches utilizing the "sendemail" command while others cannot. I am assuming this due to differing capabilities assigned to their roles. Does anyone know what capability(s) are required to run "sendemail"?
Thanks,
Chris
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did some more digging and it appears that the affected users were getting the following error:
2017-10-18 15:57:21,405 -0400 ERROR sendemail:452 - 'rootCAPath' while sending mail to: [email protected]
This led me to this question:
https://answers.splunk.com/answers/528832/e-mail-alerts-stopped-working-since-66-upgrade-for.html
As specified, I added the 'list_settings' capability to the role and it fixed the issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did some more digging and it appears that the affected users were getting the following error:
2017-10-18 15:57:21,405 -0400 ERROR sendemail:452 - 'rootCAPath' while sending mail to: [email protected]
This led me to this question:
https://answers.splunk.com/answers/528832/e-mail-alerts-stopped-working-since-66-upgrade-for.html
As specified, I added the 'list_settings' capability to the role and it fixed the issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We were getting a "command=sendmail, rootCAPath while sending mail to ..." message for users other than admins.
Adding the 'list_settings' capability fixed it.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We had upgraded from 7.2.6 to 8.0.5 recently and Adding the role list_Settings didn't work. Kindly advise.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To run |sendmail command you need "search" capability.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Okay. Is that the only capability that is needed? If that is the case, then capabilities are not our issue.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Event Series: The Agentic SOC: Trust Before Autonomy
Free Professional Services for .conf26 Attendees
Defend at Machine Speed: Your Guide to Security Sessions at .conf26
