Fewer Email alerts after upgrade to 4.1.7

[deyeo]

i've upgrade my index server from 4.1.6 to 4.1.7. after the upgrade, i notice that i receive fewer email alerts than usual. there were some emails that was suppose to be sent out but i did not receive them.

i would like to know how do i confirm that emails were sent? is there a search to find out all emails that were sent for the past 1hr?

[healthtrans · Accepted solution]

I'd actually start by checking the splunkd.log ($SPLUNK_HOME/var/log/splunk/splunkd.log) and see if you have any lines that look like this:

02-21-2011 19:00:12.409 ERROR DispatchCommand - Your maximum number of concurrent searches has been reached. usage=3 quota=3 The search was not run.

if you're not seeing anything like that, I'd then check the python.log and look for something like:

2009-08-02 20:25:29,772 ERROR Sending email. blah error

That should atleast tell you if splunk is attempting to send an email or not.

Lastly check the scheduler.log, and verify your search went off and was set to alert.

Hope this helps on your troubleshooting!