Splunk Enterprise

How do I resolve Send Email error - SMTP server?

AishwaryaAlhat
Engager

Hi all, I'm to trying to set an email alert notification using Splunk enterprise 9.0 but I am getting the following error: 

AishwaryaAlhat_0-1680232219224.png

I checked the error logs and details are below:

AishwaryaAlhat_1-1680232563182.png

Could anyone help me to understand this and guide me in right direction to resolve this error? Thanks.

Regards,

Aish

 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

this error message means that your splunk instance has configured to use user which haven't right to send email to your configured smtp-server.

Here is instructions how to configure your splunk to send emails. https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification

Be sure that your are using smtp-server which allow sending emails from your server. Usually there are some requirements which your client must fulfil before it can send email. You can get those from your SMTP server admin.

r. Ismo

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this error message means that your splunk instance has configured to use user which haven't right to send email to your configured smtp-server.

Here is instructions how to configure your splunk to send emails. https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification

Be sure that your are using smtp-server which allow sending emails from your server. Usually there are some requirements which your client must fulfil before it can send email. You can get those from your SMTP server admin.

r. Ismo

0 Karma

AishwaryaAlhat
Engager

Hi, 

I have configured the instance to SMTP server. Here are the details:

AishwaryaAlhat_0-1680477086604.png

Also, could you please explain in more detail (example) about: "Usually there are some requirements which your client must fulfil before it can send email." 

Thank you.

Regards,

Aish

0 Karma

psecure
Explorer

Hello all,

I have a problem with my configuration smtp.
When I send e-mail I get this error :

2024-02-14 16:44:15,213 +0100 ERROR cli_common:482 - Failed to decrypt value: ***************************=, error: Read custom key data size=30

Someone has an idea?

Tags (1)
0 Karma

mmacielinski
Engager

This line in $SPLUNK_HOME/lib/python3.7/site-packages/splunk/clilib/cli_common.py was the source of an error when configuration initialization is slow...

 

 if err:
    logger.error(
        'Failed to decrypt value: {}, error: {}'.format(value, err))
    return None
  return out.strip()

 

There is a wallclock message that gets in the middle of the decrypt operation causing it to fail.

Changed code to this, and problem went away.

 

if 'took wallclock_ms' no in err:
    logger.error(
        'Failed to decrypt value: {}, error: {}'.format(value, err))
    return None
  return out.strip()

 

jbgraca
Explorer

Hello,
We are facing the same issue.
How did you identify the wallclock message ? is it possible that for us is a different one?

I tried your solution after correcting the python 

 

if 'took wallclock_ms' not in err:

 

 but hasn't worked for us.
Thanks,
José

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...