Alerting

Why did email alerts stop sending after upgrading to Splunk 6.1?

EdSabine
Engager

After upgrading to 6.1, our email alerts have stopped sending.

In the splunkd.log I'm getting the following line

01-13-2015 07:25:06.258 -0500 ERROR ScriptRunner - stderr from 'C:\Program Files\Splunk\bin\PYTHON.EXE C:\Program Files\Splunk\etc\apps\search\bin\sendemail.py "results_link=https://splunk.secureiq.ca:8000/app/search/@go?sid=scheduler__admin__search__RMD50a13d0b190b0c032_at_1421151900_1351" "ssname=Alert: Error Message from Windows Application Event Log" "graceful=True" "trigger_time=1421151905" results_file="C:\\Program Files\\Splunk\\var\\run\\splunk\\dispatch\\scheduler__admin__search__RMD50a13d0b190b0c032_at_1421151900_1351\\results.csv.gz"':  ERROR:root:missing required argument: to. Please specify at least on email recipient as: "to=address@example.com"

I've tried putting the email info in the Alerts Search string, and emails are sent, however the alerts are triggered on a Cron schedule every 5 mins, so each alert sends an email every 5 mins whether there's anything to report or not.

I've also tried replacing sendemail.py and sendemail_handler.py with those below and restarting Splunk....
https://github.com/edo17/splunk/blob/master/etc/apps/search/bin/sendemail.py
https://github.com/edo17/splunk/blob/master/etc/apps/search/bin/sendemail_handler.py

Am still getting the same error in the log.

Can anyone help with this?

1 Solution

EdSabine
Engager

To update everyone on what the solution was for us.

During the upgrade from 5 to 6.1 the sendemail.py wasn't upgraded.

The sendemail.py from the github link above wasn't the incorrect one therefore didn't fix it.

I did a stand alone fresh install of v6.1.4 to my laptop, grabbed the sendmail.py from there and copied it to our Splunk server.

Emails are now sending.

View solution in original post

EdSabine
Engager

To update everyone on what the solution was for us.

During the upgrade from 5 to 6.1 the sendemail.py wasn't upgraded.

The sendemail.py from the github link above wasn't the incorrect one therefore didn't fix it.

I did a stand alone fresh install of v6.1.4 to my laptop, grabbed the sendmail.py from there and copied it to our Splunk server.

Emails are now sending.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...