Reporting

How to troubleshoot why emails are not getting sent for some reports on the search head?

lukasz92
Communicator

Hi,

I have a problem on the search head - on some reports, emails are not sent

In _internal I see events:

SavedSplunker - alert_actions="email", sid="...", suppressed=0, thread_id="AlertNotifierWorker-0"

However, I do not see events:

sendemail:112 - Sending email. subject="Splunk Report: (...(", results_link="https://splunk-pci.(...)/app/search/@go?sid=(...)", recipients="[u'(...)']", server="smtp01-pci"

How to diagnose this problem?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi lukasz92,
have you search results are in your eMail body or in attach?
verify the dimensions of your eMail and (eventually) your attachment because sometimes the problem is that eMail body or email attachment exceed the limits of your eMail server.
You can verify this triggering an alert without inserting results in the eMail body and without attaching them to the eMail.
In addition you can see Splunk logs in $SPLUNK_HOME/var/log/splunk/splunkd.log.
Bye.
Giuseppe

0 Karma

rjthibod
Champion

Look in splunkd.log in /var/log for more information and use the sendmail SPL command to test out configuration changes.

0 Karma

lukasz92
Communicator

What do you mean?

sendmail works correctly, some reports send mail.
What should I search more?

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

How many Email servers do you have in your DNS entry, you can check via nslookup command with your sendmail server name.

I faced same issue when there was problem with one of the email server. I have 4 email servers IP when I check using nslookup <email server name> and on DNS, round-robin method defined to handle traffic on all 4 email servers so when request goes to faulty email server, I didn't get email but when next email will be fired by splunk it goes to next email server which is working fine so I received email.

Thanks,
Harshil

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...