We are using Splunk Light 6.3.1. Regardless of which settings we set in Mail Server Settings, it always tries to send emails to localhost instead.
The Mail host is definitely set to a valid address, similar to foo.bar.com:587
. Checking alert_actions.conf also confirms this.
We are trying to send mail via a scheduled hourly report.
From python.log:
ERROR sendemail:115 - Sending email. subject="Splunk Report: Foo", results_link="http://splunk.domain.com:8000/app/search/@go?sid=scheduler__admin__search__Foo_at_1447151400_3", recipients="[u'user@domain.com']", server="localhost"
ERROR sendemail:378 - [Errno 111] Connection refused while sending mail to: user@domain.com
Of course the connection is refused, mail should be sent to the defined mail server, not localhost!
Any ideas? Many thanks!
v6.4 doesn't seem to have this problem...
2016-04-04 17:42:11,121 -0700 ERROR sendemail:128 - Sending email. subject="Splunk Alert: test", results_link="http://host:8000/app/search/@go?sid=scheduler__admin__search__test_at_1459816800_5", recipients="[u'user@splunk.com']", server="10.123.123.123"
2016-04-04 17:42:11,121 -0700 ERROR sendemail:393 - [Errno 110] Connection timed out while sending mail to: user@splunk.com
04-04-2016 17:42:11.122 -0700 ERROR ScriptRunner - stderr from '/home/user/light/splunk/bin/python /home/user/light/splunk/etc/apps/search/bin/sendemail.py "results_link=http://host:8000/app/search/@go?sid=scheduler__admin__search__test_at_1459816800_5" "ssname=test" "graceful=True" "trigger_time=1459816801" results_file="/home/user/light/splunk/var/run/splunk/dispatch/scheduler_adminsearch_test_at_1459816800_5/results.csv.gz"': ERROR:root:[Errno 110] Connection timed out while sending mail to: user@splunk.com
I downvoted this post because not helpful, offer suggestions rather than saying you can't replicate it
Can't confirm, unfortunately. On here, Splunk 6.4.2 still tries localhost.
I have the same problem! Did you manage to solve it ??