Update: As posted here earlier: I created a ticket because directly after the upgrade to v8.2.5 (last sunday 6 feb) because all scaling on all our dashboards with single value panels were failing.  Yesterday Wednesday 9-feb, I was asked to provide diag file which I have send. Today Thursday 10-feb, no further status info recieved yet and  still suffering from crippled dashboards. AP ... View more

Same here, on Splunk Ent. v8.2.2 ... View more

I created an idea some time ago for this issue, see sole the issue: sendemail without the cost of a security | Ideas (splunk.com) It appears to be in a stage of consideration.   ... View more

created an Idea on: sole the issue: sendemail without the cost of a security | Ideas (splunk.com)  unfortunately I have only 1 Votes yet 🙂 - so a solution soon is not expected ... View more

FyI: Recent answer from Splunk Support: Previously mentioned bugs, SPL-194202 being one of them addressed the issue where alerts created by a user with role "user" would not be sent if they didn't have the admin_all_objects capability - this has been fixed. This is different from using the "sendemail" command directly from any search - I'm afraid this is working as documented (it will not work unless the previously discussed capabilities are added to the user role), please see the documentation on that: https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification#Define_an_email_notification_action_for_an_alert_or_scheduled_report https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification#User_role_configuration_for_PDF_delivery (https://docs.splunk.com/Documentation/Splunk/8.1.3/Alert/Emailnotification#User_role_configuration_for_PDF_delivery) If you are sending an email notification to a server that requires SMTP authentication, you must have the admin role assigned. (https://docs.splunk.com/Documentation/Splunk/latest/Alert/Emailnotification#Use_a_search_command_to_... (truncated, see original email for full text) Conclusion: this will not be fixed in any version because it works as documented 😞 ... View more

Update: "sendemail" does not work for default users with default user-role capability. The issue was reported back to me to be solved in 8.1.3,  unfortunately it is not. ... View more

This issue was reported by support to be solved in v8.1.3 . Unfortunately this issue is still there in v8.1.3 ... View more

Hi Ashley, Message frome Splunk Support: .. According to the engineering department, the fix will be released in Splunk 8.1.3. Let me know if it worked for you... Regards ... View more

Just installed a complete fresh Splunk instance v8.1.2 from scratch on w2019 - no adjustments made. Only configured the smtp server setting. Tested it with admin account: sendemail works (but this has 'admin_all_objects' as a default capability. created a test account with standard user-role. (defaults without the 'admin_all_objects' capability). Sendemail does not werk without any visible error, although the search itself results in a timestamp search in serach&reporting used: | makeresults | sendemail to="[email protected]", from="[email protected]"" , subject="test-message", sendresults=false inline=true format=raw content_type=html results in python.log: Traceback (most recent call last): File ""D:\Program Files\Splunk\etc\apps\search\bin\sendemail.py"", line 1593, in <module> results = sendEmail(results, settings, keywords, argvals) File ""D:\Program Files\Splunk\etc\apps\search\bin\sendemail.py"", line 376, in sendEmail if ssContent['action.email.sendresults'] or ssContent['action.email.sendpdf'] or ssContent['action.email.sendcsv']: KeyError: 'action.email.sendpdf' ... View more

same here, I am now in version 8.1.2, no solution yet. Reported (again) to support for a final solution. https://docs.splunk.com/Documentation/Splunk/8.1.2/ReleaseNotes/KnownIssues In my opnion this is nothing else than a security breach. Security for regular user is "wide open" if you want use this sendemail function. This issue has already a long history in version and the the lack of urgency begins to worry me.   ... View more

After trying up/down, left/right, no succes sofar. ... View more

Splunk support suggest the following: I was reviewing the know issues list and I found the issue number SPL-138647, See the link below for more information. https://docs.splunk.com/Documentation/Splunk/8.1.2/ReleaseNotes/KnownIssues ... View more

exactly the same error in lines in pyhton.log 2021-03-03 13:26:49,738 +0100 ERROR sendemail:1600 - 'action.email.allowedDomainList' Traceback (most recent call last): File "D:\Program Files\Splunk\etc\apps\search\bin\sendemail.py", line 1593, in <module> results = sendEmail(results, settings, keywords, argvals) File "D:\Program Files\Splunk\etc\apps\search\bin\sendemail.py", line 469, in sendEmail   ... View more

I have the same issue, from version 7.3 , with every new version (now 8.1.2)  I hope this would be solved. Sendemail works only when you set the "Admin_All_Object" capability, but that is in fact a security breach for the regular user  ... View more

Hi, It seems to be an issue with a long history in known issues - even from version 6.6  so I understand. What should I do next? Any tips? ... View more

update from splunk support: -=-=-=-= I hope you are doing well. I was reviewing the know issues list and I found the issue number SPL-138647, See the link below for more information. https://docs.splunk.com/Documentation/Splunk/8.1.2/ReleaseNotes/KnownIssues Let me know if it worked for you. -=-=-=-= unfortunately no success yet ... View more

update from support: -==-=-=-=- I hope you are doing well. I was reviewing the know issues list and I found the issue number SPL-138647, See the link below for more information.  https://docs.splunk.com/Documentation/Splunk/8.1.2/ReleaseNotes/KnownIssues Let me know if it worked for you. -==-==-==- What I did : On our none-production instance/machine (rather a fresh installation), I did:   Changed my “alert_action.conf” file to this (see below) : (as explained in the document and is less secure as I understand from that document) – named: Workaround Removed the “Admin_All_Ojects” capability from the Test user-role No success ☹ [email] Auth_password = xx auth_username =xx from =xx mailserver = smtp.office365.com:587 sslVersions = *,-ssl2 cipherSuite = TLSv1+HIGH:TLSv1.2+HIGH:@STRENGTH Unfortunately no success   ... View more

last update Wednesday from Splunk support: "... just want to give you an update about the case, we are still working to find a solution, I engaged additional support to assist us with the issue, as soon as we have more information we will let you know. Please feel free to contact us if you have any questions." Keep you posted...   ... View more

Thanks maraman_splunk,  Unfortunately Splunk support does not respond ! They advised me earlier to select 'admin_all_objects' to use the command anyway. Because I really need the sendemail for some customer. Since v8.0 the other alternative was the option 'sendresults'  but that was also not wokring anymore. Hoped this would solved in next version, but after 8.1.2 I am till struggling with this issue and have my 'door wide open' since because of this. ... View more

Hi, Since some version (now using 8.1.2) I have trouble to use the 'sendemail' command in a search (dashboard/form) for users that have the standard user-roles. This issue is troubling me for almost  1.5 year now.  Of course I am aware of the need to select 'list_settings' but had never has any results. When selecting 'admin_all_objects' in the standard user-role it is successful.  But using the 'admin_all_objects' for standard user is nothing but a security breach. That can not be the solution , so what do I miss here? An why does Splunk not create a separate and straightforward capability for this 'sendemail' command?  Ashley Pietersen ... View more

Found it. I was working on the wrong Splunk machine 😞 Change the  .../bin/sendemail.py and look for "plainFooterTemplate" remove or replace the "------//----" string. After remove I received: "how do I get rid of the redundant characters "---" i-Alert" Thanks regards AshleyP ... View more

Yes I did, No succes. I agree it looks like a divider in the layout of the email. ... View more