This should get you everything you need: index=_internal sourcetype=splunk_python error ... View more

This should get the failed sendmail items, but doesn't appear get the ones dropped by allowed email domains list not including the domain. Still researching that use case.   index=_internal sourcetype=splunk_python ("Name or service not known while sending mail to" OR "Connection timed out while sending mail to") some | rex maybe needed to make this more useful. ... View more

I know this is an older thread, but I am searching for a good way to get notifications for when and email fails to be sent as well. I did find you can see these in $SPLUNK_HOME/var/log/splunk/python.log.  Specifically for my use case it is around the allowed domain list not having the domain listed. If I find a good way to detect this within a standard or REST Splunk search I will reply.  Hope this helps some. ... View more