About mockd

mockd · ‎05-20-2020

Ah, ok. From that snippet it looked like line 7 was "new" but that might be from the python libraries. When you said you saved the file as ANSI it worked? When I was troubleshooting the other issue I had tested on windows with no issues. Is there a chance there's some odd unicode character in the sender/subject/body fields of the alert action?

mockd · ‎05-20-2020

Hi, Can you provide some more context on the issue? It looks like you modified the alert action script based on what I see in line 7 of the code snippet? Does this happen on every use of sendresults? Thanks.

mockd · ‎05-04-2020

Hi, I was able to reproduce this issue on Windows with V5.0.0 of sendresults. Turns out it's a python2/3 thing that got missed during our testing. If you are on Windows + 8.0.x then I suggest setting Splunk to use python3 for the alert action version (make the change in local): [sendresults_alert] python.version = python3 If you are on Windows + 7.3.x then you will need to update line 206 of $SPLUNK_HOME/etc/apps/sendresults/bin/sendresults_alert.py Change from this: with gzip.open(payload.get('results_file'),'rt') as fin: To This: with gzip.open(payload.get('results_file'),'r') as fin: If you make this change you will need to revert the change back if you upgrade to Splunk 8.0.x and apply the python version change as noted. We will add an issue and address it properly in our next release. Thanks for letting us know about it. Feel free to email us at support@discoveredintelligence.ca if you have any other issues/questions about sendresults. Thanks, Derek.

mockd · ‎05-04-2020

Thanks for letting us know. I'll have to do some testing to try and reproduce it. In the short term, could you try adjusting the python version to Python3 in alert_actions.conf (make the changes in local) to see if that resolves it? [sendresults_alert] python.version = python3 Let me know if that works.

mockd · ‎10-31-2019

The owner of a KO/search etc needs to be a user, it can't be assigned to a role. So if you didn't actually have an "admin" user, then it would be considered orphaned and not scheduled.

mockd · ‎10-31-2019

Ok, that would explain it. The searches and KO's should be owned by an account with appropriate permissions/capabilities to view the data in your Splunk deployment. This is normally the "admin" user which is what is configured by default. So if you are using a different account than "admin" then they should be updated. Glad to hear it's working!

mockd · ‎10-31-2019

From what you posted, the cron schedule for the 30min search was incorrect. Did you validate if it had been changed? (ie, a local version).

mockd · ‎10-29-2019

Hi, That is a bit odd. The schedule for the 30min search should be */30 * * * * . You should be able to update it, but you might want to check if it was modified after the app was installed. You should be able to look in the meta woot app directory and see if there is a local savedsearches.conf file that would overwrite the settings from the default version.

mockd · ‎10-29-2019

Hi, A couple things to check: - Does the job inspector show the job as having run with just zero results? Or does it show any errors? - Have you confirmed that the scheduled search isn't being skipped? - The searches are owned by the "admin" user when installed. Was there any changes to the ownership and/or does your admin account exist and have the correct access to the data? Thanks!

mockd · ‎08-12-2019

Hi, Unfortunately that is not possible right now in the current version. CSS doesn't allow you to select by inner HTML values, so more info/attributes would need to be added to the generated HTML to make it work. This is an interesting idea for a new feature for the app and will add it to our feature list. We are hoping to have a new version out in time for .conf. Thanks, Derek.

mockd · ‎08-07-2019

Yes, I've looked into it, and that's a known issue with sendresults. We are looking at doing a new release in time for .conf and will see if we can match the native Splunk functionality.

mockd · ‎08-07-2019

Hi! Yes, sendresults uses the same SMTP configuration that the built-in email capabilities and as such has the same role requirements as the documentation outlines. Derek.

mockd · ‎02-15-2019

Hi, Since the body of the message is rendered as HTML, you should be able to include an HTML break tag in the body parameter to get multiple lines to work. Derek.

mockd · ‎12-25-2018

Hi, Thanks for using sendresults! The msgstyle field can be used to style the html in the message. As you can see from the examples, we generally use it to style the format of the results table (rows, header, etc.). The field takes CSS and is applied in a style tag. You cannot add custom HTML to the body as the text that's used to customize the body is meant to be text and is applied before the results table. I was able to use the SPL you posted and had it come successfully with a grey results header row and a border around the results table. If you need more assistance, please don't hesitate to reach out to support@discoveredintelligence.ca Thanks, Derek.

mockd · ‎11-16-2018

Hi, Thanks for posting about this issue. It's going to need a bit more investigation but I was able to reproduce the same issue. It looks like the sendemail command also has some issues with lesser capabilities as well. I'll do some testing and see if there is something we need to change in sendresults and/or what permissions need to be applied. Derek.

mockd · ‎10-17-2018

Thanks for using sendresults! There is no flag/setting/option that will make it behave the way you are describing, but you can get it to work by having the email_to field be a comma separated list of the email addresses you want the results to go to. Sendresults uses the email_to field as the key for grouping the rows and then when the emails are sent, it processes the field as a list.

mockd · ‎10-09-2018

Hi, thanks for raising the issue. Can you email support@discoveredintelligence.ca and we can look into this issue a bit deeper. Thanks.

mockd · ‎10-09-2018

Hi, Are you including all the necessary field in your table command that the sendresults command requires? From your example it looks like the email_to and email_subj are not.

mockd · ‎08-30-2018

Hi, if you reach out to us on the support address listed on the details section of the Splunkbase page for Sendresults, I can send you a beta version we finally have ready to be tested.

mockd · ‎11-27-2017

Hi, Thanks for the interest in the sendresults command. The idea of being able to cc the entire report in addition to the individual emails is a great idea and have added it to our list of enhancements for the command. For your question about the user with three results, that's the result that I would expect. Sendresults groups the rows to be sent based on the final value of the email_to field when the command is run and the recipients in the email_to field will get those rows. So if some rows have emailA and emailB but some rows only have emailA, then emailA will get two emails. The one that has rows in which the email_to was only emailA and an email with the rows that were emailA and emailB Hopefully that makes sense. Derek.

mockd · ‎05-05-2017

Hi, Thanks for raising the issue. I will look into what might have changed in 6.6 and get it corrected.

mockd · ‎04-08-2017

Hi! Thanks for that patch. It's a smart idea to the issue. We are working on a new release of the command and will incorporate this into it. Thanks, Derek.

mockd · ‎04-20-2016

Hi! Thank you for your interest in the sendresults command. Currently that functionality is not available, but we are looking to release a new version of the command and this would make a great feature to add in. Should be easily doable. We appreciate the feedback! D.

mockd · ‎05-29-2015

Hi, Yes, the quickest hack you can make to the code is to enable the smtplib debug flag. If you add it, then the output of the smtp session will go to stderr which is picked up in the search log for the job. You can view it in the job inspector/search log. It will be mixed in with all of the other search job output, but you should be at least be able to see what is going on. You can add it in the sendemail function in sendresults.py as follows: try: # send the mail if not use_ssl: smtp = smtplib.SMTP(server) else: smtp = smtplib.SMTP_SSL(server) smtp.set_debuglevel(True) if use_tls: smtp.ehlo() smtp.starttls() if len(username) > 0 and len(password) >0: smtp.login(username, password) It's also a great idea for a new feature for the command to capture the SMTP logs if possible.

mockd · ‎05-26-2015

Hi, Thank you for trying out the sendresults command! Sparklines are currently not supported as part of the emailed results. The command is expecting the data as passed to it to be already rendered as either a string or a number. It would be an interesting feature to get working in a future version.

Posts	32
Solutions	7
Karma Given	8
Karma Received	13
Member Since	‎05-28-2014

Online Status	Offline
Date Last Visited	‎09-25-2025 09:00 PM

Re: Failed to send email due to encoding error

Re: Failed to send email due to encoding error

Re: Sendresults not working after upgrade

Re: Sendresults not working after upgrade

Re: Enabled 30 minute search won't run/populate da...

Re: Enabled 30 minute search won't run/populate da...

Re: Enabled 30 minute search won't run/populate da...

Re: Enabled 30 minute search won't run/populate da...

Re: Enabled 30 minute search won't run/populate da...

Re: Change background color of specifc column in e...

Re: SMTPSenderRefused: (530, 'Authentication requi...

Re: SMTPSenderRefused: (530, 'Authentication requi...

Re: In the Sendresults Add-on, Is it possible to h...

Re: is it possible to add html/css to the body of ...

Re: Sendresults App: what is the minimal user cap...

Re: Is it possible to send the entire result set i...

Re: How to dynamically set the subject field in se...

Re: How to dynamically set the subject field in se...

Re: How to dynamically set the subject field in se...

Re: sendresults Command: How can I send the entire...

Re: sendresults Sparkline Support

Re: Error when there are no rows to email on

Re: Any plans on adding ability to dynamically upd...

Re: sendresults debug logging

Re: sendresults Sparkline Support

Join the Conversation