how to make sure that mail has been successfully delivered from splunk email notifications



I want to send email to a set of user returned from my search query. Now how to keep a track whether they have been successfully delivered or not ?
And if delivered how to get a list of how many mails has been sent to a particular email id in last 1 month for example.


Tags (2)
0 Karma

Super Champion

Yes I agree with @nickhillscpl, in addition to that if you want the list of all email sent out by splunk refer below:
The Python and splunkd logs would be the place to start. You can run the following query to get e-mail related activity:

index=_internal source=*python.log sendemail

If you run the same search but with splunkd.log instead, there's a field called ssname that gives the search that triggered the alert.

let me know if this helps!

Ultra Champion

Email is a "best effort" delivery mechanism.
It never was intended (nor will ever be) a guaranteed delivery service.

The Splunk logs will only show you that Splunk attempted to send an email, and the initial server accepted it.
What happens downstream has nothing to do with the sender (Splunk in this case), and nor will it be reported if the email is bounced/rejected/lost/delivered.

Now, If you own the server... you can splunk its logs to track delivery success of all emails (not just from Splunk) and correlate them to your alerts if you wish, but only as far as that mailserver can 'see'.

If you need guaranteed delivery, email is not the best choice.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...