Getting Data In

email not sending from windows search head

tyronetv
Communicator

From splunkd.log

05-29-2015 07:53:02.696 -0700 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+sourcetype%3Dt2_app+OR+sourcetype%3Ddis+iview2+%22%3Fdoc%3D%22+OR+%22%26doc%3D%22+%7C++timechart+span%3D1h+count+by+host+%7C+sendemail+to%3D%22tyrone.vaughn%40transcentra.com%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1432911162651 sent a 0 byte response after earlier claiming a Content-Length of 2160!

=============
This was working until recently. No changes that I am aware of on the machine or the environment, but I can't send email out any more. Above is the log entry when I execute that search from the interface. The interfaces responds with No connection could be made because the target machine actively refused it while sending mail to: (my email address).

I can send email from Powershell using:

 $EmailFrom = "(source address)"
 $EmailTo = "(my address, same as above)"
 $Subject = "Test from CLI"
 $Body = "Testing.. 1 2 3"
 $SMTPServer = "(my relay, same one in Splunk config)
 $SMTPClient =  New-Object Net.Mail.SmtpClient($SMTPServer, 25)
 $SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)

So I don't think it is a machine issue.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Do a test alert email preview from the UI, and check your splunkd.log

0 Karma

tyronetv
Communicator

"test alert email preview" Could you explain that to me?

I did do an attempted send via "sendemail" from the search line and received the same errors.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Not sure what version you are using in Splunk, but in any case, just look in the $SPLUNK_HOME/var/log/splunk/splunkd.log for clues.

0 Karma

tyronetv
Communicator

See above. I included a splunkd.log output.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...