Getting Data In

email not sending from windows search head

tyronetv
Communicator

From splunkd.log

05-29-2015 07:53:02.696 -0700 ERROR HttpListener - Handler for /en-US/api/shelper?snippet=true&snippetEmbedJS=false&namespace=search&search=search+sourcetype%3Dt2_app+OR+sourcetype%3Ddis+iview2+%22%3Fdoc%3D%22+OR+%22%26doc%3D%22+%7C++timechart+span%3D1h+count+by+host+%7C+sendemail+to%3D%22tyrone.vaughn%40transcentra.com%22&useTypeahead=true&useAssistant=true&showCommandHelp=true&showCommandHistory=true&showFieldInfo=false&_=1432911162651 sent a 0 byte response after earlier claiming a Content-Length of 2160!

=============
This was working until recently. No changes that I am aware of on the machine or the environment, but I can't send email out any more. Above is the log entry when I execute that search from the interface. The interfaces responds with No connection could be made because the target machine actively refused it while sending mail to: (my email address).

I can send email from Powershell using:

 $EmailFrom = "(source address)"
 $EmailTo = "(my address, same as above)"
 $Subject = "Test from CLI"
 $Body = "Testing.. 1 2 3"
 $SMTPServer = "(my relay, same one in Splunk config)
 $SMTPClient =  New-Object Net.Mail.SmtpClient($SMTPServer, 25)
 $SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)

So I don't think it is a machine issue.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Do a test alert email preview from the UI, and check your splunkd.log

0 Karma

tyronetv
Communicator

"test alert email preview" Could you explain that to me?

I did do an attempted send via "sendemail" from the search line and received the same errors.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Not sure what version you are using in Splunk, but in any case, just look in the $SPLUNK_HOME/var/log/splunk/splunkd.log for clues.

0 Karma

tyronetv
Communicator

See above. I included a splunkd.log output.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...