Alert and reports not coming to mailbox

[aravind]

Hi,

We are experiencing a critical issue where several scheduled alerts/reports are not being received by intended recipients. This issue affects both individual mailboxes and distribution lists. Initially, only a few users reported missing alerts. However, it has now escalated, with all members of the distribution lists no longer receiving several key reports. Only a few support team members  continue to receive alerts in their personal mailboxes, suggesting inconsistent delivery.

Also just checking, is there is any suppression list blocking

[PickleRick]

The first thing would be to verify whether the scheduled searches were run in the first place. If they were and triggered alert actions, you should verify whether the emails were correctly sent (Ismo already provided links to other similar threads). Then you'll know where to start troubleshooting - if it's a Splunk issue because the mails weren't sent or if you need to search on the receiving end why they weren't delivered.

[isoutamo]

Have you look from splunk's internal logs if those alerts has working and try to send emails?

There are some links to old answers how you could try to figure out it.

• Solved: Splunk stopped sending Email for alerts and report... - Splunk Community
• How to troubleshoot why I'm not getting email aler... - Splunk Community
• Re: Where are the failures of sendemail logged in? - Splunk Community
• Sendemail not working - Splunk Community

After you have check those and look if you can find answer from those and it's still issue, please show what you have in your logs about those sendemail parts.

Quite often situation is that splunk has sent those alerts, but those are vanished in somewhere else.

[aravind]

can you share the  support mail address or any contacts.Because, i have tried to raise a ticket in support, but its failed.

[livehybrid]

Hi @aravind 

There isnt a suppression list which customers can access, however if you log a support ticket they are able to check the PostMark mail server logs to check if any emails bounced, this could help confirm that 
a) If the alert actually fired correctly
b) Email accepted by the mail relay
c) If the relay had any issue sending on to the final destination.

At a previous customer we had a number of issues with the customer email server detecting some of the Splunk Cloud alerts as spam and silently bouncing them.

You can contact Support via https://www.splunk.com/support

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing