Email alert not triggering

[maheshnc]

Hello, we have a DMC configured on Splunk Licence Master, I need to enable all the critical resource utilization alerts on DMC and send email notifications. I have configured the server setting under settings>server setting>Email settings and set up the same configurations as on our search head (which is successfuly generating email notifications) but the thing is, alerts are triggering but but I am not receiving any email notifications. can somebody help me to figure out the root cause?

Note: Network connectivity established between mail server and LM server.

[SK99]

@maheshnc , you might need to enable email relay from your DMC/LM server to Email server in order to send internal emails (as per your organizational policies.)

[PickleRick]

I don't think you can "enable forwarding" on outlook com. You need to properly authenticate.

[SK99]

Yes, with email relay there is option for "IP address authentication"; means to authorize a specific server's IP address to send email through the relay service.

[PickleRick]

Interesting. Didn't expect that. But be aware that since you're most probably not using static public IPs on your Splunk components you'd be opening relaying from whatever is NAT-ed to the same IP.

[VatsalJagani]

@maheshnc - Search for internal logs to understand and troubleshoot the issue further.

index=_internal NOT source=*_access* "<title of the alert>"

And see what logs tell you.

I hope this helps!!! Kindly upvote!!!

[maheshnc]

Getting this error, not sure why

[PickleRick]

Well... this is something that should be troubleshot with your email admins because there is apparently something wrong with your Splunk trying to authenticate to the email server.

[PickleRick]

Or specifically - if the alert _is_ being triggered but there is a problem with email delivery, search for anything regarding sendemail.py