Query email sent success or failed

[shanaz]

Please suggest a splunk query to find whether email abc@def.com successfully sent emails or any emails failed between 5-6pm to qbc@xyz.com. 

[ro_mc · Accepted solution]

You should adjust the following query based on the index and sourcetype of your email data.

If you don't have extracted fields, you can just list the email addresses on the first line.

sender_field=abc@def.com recipient_field=qbc@xyz.com
earliest="9/20/2021:17:00:00" latest="9/20/2021:18:00:00"
| stats count by sender_field, recipient_field, status

Alternatively, you can schedule an alert to run with a cron schedule of 5 18 * * * with an earliest -65m@m and latest of -5m@m.

The status is the field that advises of success or failure. If this is not present, you can extract it using something like

| rex field=_raw "<text before status>(?<status>[^\s]+)"

This will extract one or more characters after the specified text up until the next space.

[richgalloway]

Search splunkd.log for "sendemail" or the specific email address(es).