Splunk Dev

How to send email via SSL/TLS using localhost?

jadamsplunk
Path Finder

Hello all,

I am attempting to get my Splunk VM to send email via SSL or TLS using the localhost settings. I want to use localhost because I do not have access to any mail relay (3rd party such as GMAIL, HOTMAIL, etc are out of the question). When I configure Splunk to use SSL/TLS and then I run a simple sendemail test ( index=_audit | head 3 | sendemail to="me@me.com" use_ssl=true / index=_audit | head 3 | sendemail to="me@me.com" use_tls=true) I get the following error:

command="sendemail", [Errno 111] Connection refused while sending mail

The actual intent of this is to successfully send email from localhost using SSL/TLS from a python script I've written as part of an app I'm submitting for approval to Splunk Cloud, which was denied because I was sending email without SSL. It works fine with non-SSL but it fails with localhost settings.

I feel like there may be something fundamental I'm missing.

Labels (1)
0 Karma

livehybrid
Super Champion

Would it be possible to create a toggle in the settings of your app for SSL, defaulting to *True* but giving you the option to set to False once uploaded?

It does sound a little odd though, If it isnt using SSL when sending to localhost then I'm not sure how they can enforce it for your own app that uses the same mechanism?

It might be worth asking for an escalation through support to see if you can come to an agreement with them.

0 Karma
Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...