Alerting

How to troubleshoot why one of our users is not receiving email alerts from Splunk?

Kaushikkatta03
Explorer

This is one of the example email alerts:


Saved search results. 

Name: 'Cisco - Level 3 Internet BGP Drops (dcinternet02r)' 
Query Terms: 'source=\"/var/log/syslog_info\" _raw=*\"%BGP-5-ADJCHANGE: neighbor 4.15.168.57\"* earliest=-36hr@h | table _time, _raw | sort -_time' 
Link to results: https://splunk.********.com/
sid=scheduler__hfmra200__search__RMD5ce14eefd70aff3f9_at_1459853760_15001 
Alert was triggered because of: 'Saved Search [Cisco - Level 3 Internet BGP Drops (dcinternet02r)]: always(0)' 
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Verify the user's email address is correct in the alert.
Ask the user to check his spam folder and mail filters.

---
If this reply helps you, Karma would be appreciated.

Kaushikkatta03
Explorer

Everything are good , from there side email address and he check in spam fold. He haven't received any mails.

And if i try to run commands under the applications which are in saved search, like:

source=\"/var/log/syslog_info\" _raw=\"%BGP-5-ADJCHANGE: neighbor 4.15.168.57\" earliest=-36hr@h | table _time, _raw | sort -time 

I cant see any data . "No data found "

0 Karma

pradeepkumarg
Influencer

Is he the only recipient for the alert? If so, check sourcetype = python_log logs for any errors in sending email. If there are other recipients for the alert check with them to see if they got the email and you can validate the to distribution list from that email

0 Karma

pradeepkumarg
Influencer

Sorry, I didn't realize python logs are not indexed by default and you have to specifically index them. But you can find them here $SPLUNK_HOME/var/log/splunk/python.log

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...