Splunk Search

Search head error in Email action

bhupalbobbadi
Path Finder

Hi Team,

 

We have 2 search head cluster, and few reports scheduled with email action, reports running on one search head is working fine and delivering emails as configured. but another search head is running the report but email is not delivered, I see the following ERROR logs in Inspect job. 

04-01-2025 01:00:10.298 ERROR HttpClientRequest [1028078 StatusEnforcerThread] - HTTP client error=Read Timeout while accessing server=https://127.0.0.1:8089 for request=https://127.0.0.1:8089/servicesNS/nobody/botcop/saved/searches/SOMEREPORT/notify.
04-01-2025 01:00:10.299 ERROR SearchNotification [1028078 StatusEnforcerThread] - OnResult notification failed uri=https://127.0.0.1:8089/servicesNS/nobody/botcop/saved/searches/SOMEREPORT/notify postData= method=POST err=Read Timeout status=502

any idea how to fix this? I see the port on SH is listening and accepting connection--tested with telnet. 

thanks in advance for any help you may have.

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bhupalbobbadi ,

if I correctly understood your problem, your second SH doesn't send emails, is it correct?

did you checked that the connection between this SH and the mail server (using telnet from the SH to the mail server) is open on the used port?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...