- Splunk Answers
- :
- Using Splunk
- :
- Reporting
- :
- User is not getting report
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
User is not getting report
A user complained that he is not getting report. He claims that he created the report in the month of December and till 7th January he was getting the report. After 7th January he is not getting report. The schedule of the report is 12 AM every day.
What could be the reason. Is it the permissions problem. If yes, what permissions we need to check.
Is there any log to check whether the report has run or not?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We did further troubleshooting.
We verified python.log file in search head server and found the following error.
sendemail:460 - (552, '5.3.4 Message size exceeds fixed limit', u'splunk@somehost.company.corp') while sending mail to: user1@email.com
We informed the same to the user, but user has not convinced. He said that the size of the report that he was receiving was less than 1 MB.
What are the limits of the mail size.
Please help us in fixing this issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi pratapa,
SMTP error message 552 tells you that the message size is exceeded on one of the mail servers that were trying to send this email. This can be either your mail relay server (the one you configured in Splunk to send the emails) or the receiving email server that handles the incoming email traffic for the recipients domain.
This is not related to any limit in Splunk, this is all about configuration of the email servers.
Hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We informed the same to the user.
User asked us to reconfigure 'sendmail' Message Transfer Agents in the blocked email’s path to allow larger attachments.
How to do this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't. Sendmail is not part of Splunk. It is a separate service, often of different servers, and often run by different staff. Contact your email provider for assistance.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are many factors that could be preventing him from getting the report, some of which are external to Splunk. Check scheduler.log for when the report last ran. Check splunkd.log for sendemail errors. Have the user verify the report is not in his junk email folder.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We checked in scheduler.log and found that report is running as per the schedule.
Also we checked in splunkd.log for sendmail errors but there are no sendmail errors.
What could be the other possible reasons?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If the report is running, and there are no sendmail errors, that would suggest that Splunk is sending the rport correctly.
For answers as to why the user is not recieving the report, you might need to check your email service and see if there are any reasons it is being rejected.
I have had similar issues with Gsuite - reports sent to users with multiple users on the to: line get bounced.
My work around was to create a group in Gsuite, and add those users to it - then the report is sent to the single address for the group.
What /why this happens I never got to the bottom of it, but as @richgalloway notes, this is external to Splunk, and something to follow up with your mail provider.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@pratapa could you try sending manual email from search command? Check if user getting an email for the same.
Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
