Reporting

Where does splunk log email failures

adoshi
Explorer

It seems that Splunk is not sending the emails when the alerts are triggered. Is there any place where I can see what errors were logged when splunk tried to send the alert email?

Labels (1)
Tags (1)
0 Karma

Amandeepsin
New Member

Check

cat /var/log/maillog

Check if any connection is refused by SMTP Server... If yes, then inform your IT Team

0 Karma

Amandeepsin
New Member

Try to check under Server Settings and Then Email Settings
Afterwards check Alert Action on Splunk UI

0 Karma

johnquinn
Explorer

Maillog doesn't exist on Insights for infrastructure and our python.log file is empty.
SMTP server settings are set the same way as many other systems, but the alerts from splunk do not get sent.
Need a way to troubleshoot the issues.

Thanks,

0 Karma

yannK
Splunk Employee
Splunk Employee

Check in $SPLUNK_HOME/var/log/splunk/python.log

or use the search :
index=_internal source=*python.log*

gjanders
SplunkTrust
SplunkTrust

I created an alert called "AllSplunkEnterpriseLevel - Email Sending Failures", if you needed an example it's available in github here or the app with all the alerts is available here, Alerts For Splunk Admins

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
0 Karma

adoshi
Explorer

Thank you.

0 Karma

woodcock
Esteemed Legend

You should click Accept on this answer, @adoshi, to close the question.

0 Karma

gjanders
SplunkTrust
SplunkTrust

@woodcock it might be worth noting this is a 2012 post and the user was last seen in 2015...

Alerts for Splunk Admins https://splunkbase.splunk.com/app/3796/
Version Control for Splunk https://splunkbase.splunk.com/app/4355/
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!