Reporting

What capabilities are needed to run sendemail command?

chrishartsock
Path Finder

Hello all,

Certain users in our environment seem to be able to run searches utilizing the "sendemail" command while others cannot. I am assuming this due to differing capabilities assigned to their roles. Does anyone know what capability(s) are required to run "sendemail"?

Thanks,
Chris

0 Karma
1 Solution

chrishartsock
Path Finder

I did some more digging and it appears that the affected users were getting the following error:
2017-10-18 15:57:21,405 -0400 ERROR sendemail:452 - 'rootCAPath' while sending mail to: xxxxxx@buttercupgames.com

This led me to this question:
https://answers.splunk.com/answers/528832/e-mail-alerts-stopped-working-since-66-upgrade-for.html

As specified, I added the 'list_settings' capability to the role and it fixed the issue.

View solution in original post

chrishartsock
Path Finder

I did some more digging and it appears that the affected users were getting the following error:
2017-10-18 15:57:21,405 -0400 ERROR sendemail:452 - 'rootCAPath' while sending mail to: xxxxxx@buttercupgames.com

This led me to this question:
https://answers.splunk.com/answers/528832/e-mail-alerts-stopped-working-since-66-upgrade-for.html

As specified, I added the 'list_settings' capability to the role and it fixed the issue.

kamaljagga
Path Finder

We had upgraded from 7.2.6 to 8.0.5 recently and Adding the role list_Settings didn't work. Kindly advise.

0 Karma

hardikJsheth
Motivator

To run |sendmail command you need "search" capability.

0 Karma

chrishartsock
Path Finder

Okay. Is that the only capability that is needed? If that is the case, then capabilities are not our issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...