External search command 'sendemail' returned error code 1

[babukumarreddy]

Hi,


One of use case giving below error while sending email to recipients.

The use case configured to run every 20 mins and the use case alert trigger action is send alert and notable.  we cannot see the  results in notable index and we are not receiving the email.

If we ran the use case manually we can see the results.

I have checked in python logs, nothing found about use case

Error message

08-17-2023 03:04:34.681 +0000 ERROR ScriptRunner [6973 AlertNotifierWorker-0] - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://XXxxx-splunk.com/app/SplunkEnterpriseSecuritySuite/@go?sid=scheduler_c29jX2VzX3JlcG9ydA__Spl..." "ssname=xxxxxx- xxxx-xx-xxx -  - Rule" "graceful=True" "trigger_time=1692241474" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_c29jX2VzX3JlcG9ydA__SplunkEnterpriseSecuritySuite__"': _csv.Error: line contains NUL

External search command 'sendemail' returned error code 1.

[yuanliu]

Error code 1 simply means that python exited with an error. (sendmail.py doesn't explicitly define exit codes.) About the only thing you can do is to put the quoted command line in a terminal and run with the same user that runs Splunkd, and troubleshoot the script.  The command line is

/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/search/bin/sendemail.py "results_link=https://XXxxx-splunk.com/app/SplunkEnterpriseSecuritySuite/@go?sid=scheduler_c29jX2VzX3JlcG9ydA__Spl..." "ssname=xxxxxx- xxxx-xx-xxx -  - Rule" "graceful=True" "trigger_time=1692241474" results_file="/opt/splunk/var/run/splunk/dispatch/scheduler_c29jX2VzX3JlcG9ydA__SplunkEnterpriseSecuritySuite__"

To run this, you will need a realistic results_file that is from your scheduled search.  In the log, the file is "/opt/splunk/var/run/splunk/dispatch/scheduler_c29jX2VzX3JlcG9ydA__SplunkEnterpriseSecuritySuite__" although each run will probably generate a different file. (You don't have to worry about results_link.)  The error seems to suggest that the file is bad, like it is not empty but contains an empty line or something.

Hope this helps.