Splunk Enterprise
Highlighted

Not getting email from Splunk

New Member

Hi Everyone,

Could you please help me to find out the issue with my Splunk instance.

I am not getting email from splunk for the scheduled report/alert.

Splunk version: 6.6.2

SMTP server is configured on that local server and port 25 is open.

1. for testing triggered email command from powershell in this case I am getting email .

 

$MailparamsDisable = @{
'To' = 'himanshu.b.shekhar@xyz.com'
'Subject' = 'xyz account maintenance'
'From' = 'IAM.Admin@xyz.com'
'SmtpServer' = 'xyz.abc.com'
'Body' = "Hi Splunk"

}
Send-MailMessage @MailparamsDisable

 

 

2. but from splunk i am not getting email.

index=_internal
| head 5
| sendemail
to="himanshu.b.shekhar@xyz.com"
server="xyz.abc.com:25"
subject="Here is an email notification"
message="This is an example message"
sendresults=true inline=true
format=raw sendpdf=true


Search Factory: Unknown search command 'sendemail'.

what could be issue please help me on this.

 

Thank in advance.

 

Thank You,

Himanshu

Labels (1)
Tags (1)
0 Karma
Highlighted

Re: Not getting email from Splunk

SplunkTrust
SplunkTrust
Verify the $SPLUNK_HOME/etc/apps/search/bin/sendemail.py file is still present

BTW, 6.6.2 is an unsupported version. Consider upgrading.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Not getting email from Splunk

New Member

Hi Richgalloway,

Thanks for your reply.

As  i verified  "E:\Program Files\Splunk\etc\apps\search\bin\sendemail.py" is exist .

What could be other options to fix this issue rather than upgrading?

 

Thank you,

Himanshu 

0 Karma
Highlighted

Re: Not getting email from Splunk

SplunkTrust
SplunkTrust
Go to Settings->Advanced Search->Search Commands and verify sendemail is there with the right permissions and is not disabled.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Not getting email from Splunk

New Member

Hi Richgalloway,

In below path , i do not have sendemail search :

Go to Settings->Advanced Search->Search Commands and verify sendemail is there with the right permissions and is not disabled.

 

In message tab i can see -

"Your license for Splunk App for Microsoft Exchange has expired or cannot be found."

is it related to this issue ?

 

Thank You,

Himanshu

0 Karma
Highlighted

Re: Not getting email from Splunk

SplunkTrust
SplunkTrust
Those are two unrelated problems.

Consider re-installing Splunk.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.