Splunk Search

Search head error in Email action

bhupalbobbadi
Path Finder

Hi Team,

 

We have 2 search head cluster, and few reports scheduled with email action, reports running on one search head is working fine and delivering emails as configured. but another search head is running the report but email is not delivered, I see the following ERROR logs in Inspect job. 

04-01-2025 01:00:10.298 ERROR HttpClientRequest [1028078 StatusEnforcerThread] - HTTP client error=Read Timeout while accessing server=https://127.0.0.1:8089 for request=https://127.0.0.1:8089/servicesNS/nobody/botcop/saved/searches/SOMEREPORT/notify.
04-01-2025 01:00:10.299 ERROR SearchNotification [1028078 StatusEnforcerThread] - OnResult notification failed uri=https://127.0.0.1:8089/servicesNS/nobody/botcop/saved/searches/SOMEREPORT/notify postData= method=POST err=Read Timeout status=502

any idea how to fix this? I see the port on SH is listening and accepting connection--tested with telnet. 

thanks in advance for any help you may have.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bhupalbobbadi ,

if I correctly understood your problem, your second SH doesn't send emails, is it correct?

did you checked that the connection between this SH and the mail server (using telnet from the SH to the mail server) is open on the used port?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...