Reporting

Where does splunk log email failures

adoshi
Explorer

It seems that Splunk is not sending the emails when the alerts are triggered. Is there any place where I can see what errors were logged when splunk tried to send the alert email?

Labels (1)
Tags (1)
0 Karma

Amandeepsin
New Member

Check

cat /var/log/maillog

Check if any connection is refused by SMTP Server... If yes, then inform your IT Team

0 Karma

Amandeepsin
New Member

Try to check under Server Settings and Then Email Settings
Afterwards check Alert Action on Splunk UI

0 Karma

johnquinn
Explorer

Maillog doesn't exist on Insights for infrastructure and our python.log file is empty.
SMTP server settings are set the same way as many other systems, but the alerts from splunk do not get sent.
Need a way to troubleshoot the issues.

Thanks,

0 Karma

yannK
Splunk Employee
Splunk Employee

Check in $SPLUNK_HOME/var/log/splunk/python.log

or use the search :
index=_internal source=*python.log*

gjanders
SplunkTrust
SplunkTrust

I created an alert called "AllSplunkEnterpriseLevel - Email Sending Failures", if you needed an example it's available in github here or the app with all the alerts is available here, Alerts For Splunk Admins

0 Karma

adoshi
Explorer

Thank you.

0 Karma

woodcock
Esteemed Legend

You should click Accept on this answer, @adoshi, to close the question.

0 Karma

gjanders
SplunkTrust
SplunkTrust

@woodcock it might be worth noting this is a 2012 post and the user was last seen in 2015...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...