ERROR [Errno 111] Connection refused while sending mail to:


We are running splunk 4.2.3 on RHEL 5.I am scheduling a job in windows app and email the results to my email id but i am not receiving any emails from splunk server. I am seeing these below connection refused errors in python.log

2011-11-03 21:19:01,489 ERROR Sending email. subject="Splunk Alert: windows failed", results_link="https://splunk_server_name:8000/app/windows/@go?sid=scheduler__admin__windows_d2luZG93cyBmYWlsZWQ_at...", recepients="['', '', '']"
2011-11-03 21:19:01,489 ERROR [Errno 111] Connection refused while sending mail to:

There are no issues with firewall or iptables. I am able to send emails from the actual splunk server itself but not from the alert/report. I configured "Link Hostname" to the ip of the server, server hostname, left it blank but still no luck.

Tags (1)


I ran into this as well. This happened after I copied some alert from another system to setup on a new search head.

The problem turned out to be that I created the alerts before configuring the mail server in Splunk, so the alerts had this statement in savedsearches.conf: = localhost

Manually edited savedsearches.conf to remove this (as well as, which was "splunk").

After restarting Splunk, the alerts mail properly.

0 Karma


In "Mail Server Settings" the mail host was set to localhost and hence it was not sending emails when i ran the report. Now i have configured mail host with the mail server host name and now email are triggering fine from the splunk.


I am not sure the root cause of the issue. But sendemail command may help you to isolate the issue. You will know more if smtp setting is correct or semdemail python command is ok or network issue...

... | sendemail to="," format=html subject=myresults

Get Updates on the Splunk Community!

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Admin Console: A Single, Unified Interface for All Your Cloud Admin Needs

WATCH NOWJoin us to learn how the admin console can save you time and give you more control over the Splunk® ...