Hi Experts,
I have configured email alerts on my splunk server. when i run the sendemail command;
Eg:
index=syslog | head 5 | sendemail to="Test.User@Test.local" server="smtp.test.local" subject="Here is an email notification" message="This is an example message"
I am getting below error message
command="sendemail", (421, '4.3.2 Service not available') while sending mail to: Test.User@Test.local
Any idea what might causing this issue ?
With Email, sometimes it is just easier to attempt to deliver a message using telnet from the command line of the server to see what is the issue with email server.
Here is great technet article that describes the smtp commands:
https://technet.microsoft.com/en-us/library/aa995718%28v=exchg.65%29.aspx
If you get the same error response you can eliminate Splunk from the issue, and focus on the mail server, from address, to address etc as being the issue.
With Email, sometimes it is just easier to attempt to deliver a message using telnet from the command line of the server to see what is the issue with email server.
Here is great technet article that describes the smtp commands:
https://technet.microsoft.com/en-us/library/aa995718%28v=exchg.65%29.aspx
If you get the same error response you can eliminate Splunk from the issue, and focus on the mail server, from address, to address etc as being the issue.
there was an access list configured on our SMTP server. that was the issue. many thanks for the help.
This is the search command i am trying to run;
index=syslog | head 5 | sendemail to=Test.User@Test.local server=smtp.test.local subject="Here is an email notification" message="This is an example message"
Have you looked at splunkd.log?