Hi daniel333,
I realize that this question was asked quite a while back, but in case this is still an issue for you or anyone else I'll try and answer this question as best I can.
If you already configured your mail settings under Settings -> Server Settings -> Email settings and configured an alert, just as I did and noticed that no mail was sent when the trigger occurred. Then what you could do is run the following search index=_internal source="/opt/splunk/var/log/splunk/python.log" sendemail. This gave me an event stating "Application-specific password required" and referred me to https://support.google.com/mail/?p=InvalidSecondFactor. The link explained who to create an App specific password. This generated password should be pasted in under the mail configuration in your Splunk environment.
The settings I used under splunk was.
Mail host: smtp.gmail.com:587
Email Security: Enable TLS
Username: [[email protected]]
Password: [The app specific password]
I hope this is of any help to you or anyone else having this issue and if this don't resolve your issue then the SPL query above can still provide valuable information as to where the issue lies.
Best of luck and happy Splunking
