Reporting

how to make sure that mail has been successfully delivered from splunk email notifications

surekhasplunk
Communicator

Hi,

I want to send email to a set of user returned from my search query. Now how to keep a track whether they have been successfully delivered or not ?
And if delivered how to get a list of how many mails has been sent to a particular email id in last 1 month for example.

Thanks

Tags (2)
0 Karma

mayurr98
Super Champion

Yes I agree with @nickhillscpl, in addition to that if you want the list of all email sent out by splunk refer below:
The Python and splunkd logs would be the place to start. You can run the following query to get e-mail related activity:

index=_internal source=*python.log sendemail

If you run the same search but with splunkd.log instead, there's a field called ssname that gives the search that triggered the alert.

let me know if this helps!

nickhills
Ultra Champion

Email is a "best effort" delivery mechanism.
It never was intended (nor will ever be) a guaranteed delivery service.

The Splunk logs will only show you that Splunk attempted to send an email, and the initial server accepted it.
What happens downstream has nothing to do with the sender (Splunk in this case), and nor will it be reported if the email is bounced/rejected/lost/delivered.

Now, If you own the server... you can splunk its logs to track delivery success of all emails (not just from Splunk) and correlate them to your alerts if you wish, but only as far as that mailserver can 'see'.

If you need guaranteed delivery, email is not the best choice.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...