Not receiving alert email consistently

[ubko]

I haven't found any log related to SMTP activities. And there doesn't seem to be any "smtp" or "mail" logging setting. Would starting Splunk in debug mode show SMTP activities?

[gkanapathy]

The email script is actually an external search script, and the scheduler simply triggers that to send emails. It does not log all that much, but when it does, it logs to python.log. You might need to change the log level in log.cfg to see more.

[gkanapathy]

$SPLUNK_HOME/etc/apps/search/bin/sendemail.py. Don't edit that script. Instead, copy it, modify the copy, then override the filename for the sendemail command in commands.conf (with a local commands.conf, not by editing the default commands.conf).

[ubko]

Thanks. Do you know what that script is called?

[the_wolverine]

I've encountered various bugs related to alerts misfiring. You should contact support and provide specific details as to version and conditions of the alert. One thing that was consistent at one time was if you were alerting on a resultset > 10000, I found that the alert would run but no email was sent. You could try updating your alert (add | head 1000, or similar) to keep the eventcount low and test to see if you get consistent alerts in this case.

[ubko]

Thanks. My alerts report very small resultset (a few lines, no more than 100). I'll contact support.

[yannK]

The mails are linked to the scheduled searches.

Check if our search worked, and returned results, if a mail was sent, and if the mail failed.

look in : $SPLUNK_HOME/var/log/splunk/scheduler.log

or do a search on :

index=_internal source="*scheduler.log*"

[ubko]

The job did run. Only the email did not arrive.