Reporting

Why does Splunk Light 6.3.1 always try to send scheduled report emails to localhost, regardless of Mail Server Settings?

secomba
Engager

We are using Splunk Light 6.3.1. Regardless of which settings we set in Mail Server Settings, it always tries to send emails to localhost instead.

The Mail host is definitely set to a valid address, similar to foo.bar.com:587. Checking alert_actions.conf also confirms this.

We are trying to send mail via a scheduled hourly report.

From python.log:

ERROR   sendemail:115 - Sending email. subject="Splunk Report: Foo", results_link="http://splunk.domain.com:8000/app/search/@go?sid=scheduler__admin__search__Foo_at_1447151400_3", recipients="[u'user@domain.com']", server="localhost"
ERROR   sendemail:378 - [Errno 111] Connection refused while sending mail to: user@domain.com

Of course the connection is refused, mail should be sent to the defined mail server, not localhost!

Any ideas? Many thanks!

jterry
Splunk Employee
Splunk Employee

v6.4 doesn't seem to have this problem...

2016-04-04 17:42:11,121 -0700 ERROR sendemail:128 - Sending email. subject="Splunk Alert: test", results_link="http://host:8000/app/search/@go?sid=scheduler__admin__search__test_at_1459816800_5", recipients="[u'user@splunk.com']", server="10.123.123.123"
2016-04-04 17:42:11,121 -0700 ERROR sendemail:393 - [Errno 110] Connection timed out while sending mail to: user@splunk.com
04-04-2016 17:42:11.122 -0700 ERROR ScriptRunner - stderr from '/home/user/light/splunk/bin/python /home/user/light/splunk/etc/apps/search/bin/sendemail.py "results_link=http://host:8000/app/search/@go?sid=scheduler__admin__search__test_at_1459816800_5" "ssname=test" "graceful=True" "trigger_time=1459816801" results_file="/home/user/light/splunk/var/run/splunk/dispatch/scheduler_adminsearch_test_at_1459816800_5/results.csv.gz"': ERROR:root:[Errno 110] Connection timed out while sending mail to: user@splunk.com

atat23
Path Finder

I downvoted this post because not helpful, offer suggestions rather than saying you can't replicate it

0 Karma

secomba
Engager

Can't confirm, unfortunately. On here, Splunk 6.4.2 still tries localhost.

0 Karma

DavidHourani
Super Champion

I have the same problem! Did you manage to solve it ??

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...