Alerting

Splunk Email alerts

Irosha
New Member

Hi Experts,

I have configured email alerts on my splunk server. when i run the sendemail command;

Eg:
index=syslog | head 5 | sendemail to="Test.User@Test.local" server="smtp.test.local" subject="Here is an email notification" message="This is an example message"

I am getting below error message

command="sendemail", (421, '4.3.2 Service not available') while sending mail to: Test.User@Test.local

Any idea what might causing this issue ?

Tags (1)
0 Karma
1 Solution

dgrubb_splunk
Splunk Employee
Splunk Employee

With Email, sometimes it is just easier to attempt to deliver a message using telnet from the command line of the server to see what is the issue with email server.

Here is great technet article that describes the smtp commands:

https://technet.microsoft.com/en-us/library/aa995718%28v=exchg.65%29.aspx

If you get the same error response you can eliminate Splunk from the issue, and focus on the mail server, from address, to address etc as being the issue.

View solution in original post

0 Karma

dgrubb_splunk
Splunk Employee
Splunk Employee

With Email, sometimes it is just easier to attempt to deliver a message using telnet from the command line of the server to see what is the issue with email server.

Here is great technet article that describes the smtp commands:

https://technet.microsoft.com/en-us/library/aa995718%28v=exchg.65%29.aspx

If you get the same error response you can eliminate Splunk from the issue, and focus on the mail server, from address, to address etc as being the issue.

0 Karma

Irosha
New Member

there was an access list configured on our SMTP server. that was the issue. many thanks for the help.

0 Karma

Irosha
New Member

This is the search command i am trying to run;

index=syslog | head 5 | sendemail to=Test.User@Test.local server=smtp.test.local subject="Here is an email notification" message="This is an example message"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you looked at splunkd.log?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...