how to make sure that mail has been successfully delivered from splunk email notifications



I want to send email to a set of user returned from my search query. Now how to keep a track whether they have been successfully delivered or not ?
And if delivered how to get a list of how many mails has been sent to a particular email id in last 1 month for example.


Tags (2)
0 Karma

Super Champion

Yes I agree with @nickhillscpl, in addition to that if you want the list of all email sent out by splunk refer below:
The Python and splunkd logs would be the place to start. You can run the following query to get e-mail related activity:

index=_internal source=*python.log sendemail

If you run the same search but with splunkd.log instead, there's a field called ssname that gives the search that triggered the alert.

let me know if this helps!

Ultra Champion

Email is a "best effort" delivery mechanism.
It never was intended (nor will ever be) a guaranteed delivery service.

The Splunk logs will only show you that Splunk attempted to send an email, and the initial server accepted it.
What happens downstream has nothing to do with the sender (Splunk in this case), and nor will it be reported if the email is bounced/rejected/lost/delivered.

Now, If you own the server... you can splunk its logs to track delivery success of all emails (not just from Splunk) and correlate them to your alerts if you wish, but only as far as that mailserver can 'see'.

If you need guaranteed delivery, email is not the best choice.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...