ERROR Sending email with sendemail, but alert emails work fine

Question

I have my smtp server configured correctly and have setup and do receive plenty of alerts for scheduled searches. However when I attempt to use the sendemail command, the following error is displayed:

[Errno 10061] No connection could be made because the target machine actively refused it while sending mail to: foo@bar.com

The only error I can find in the logs is from var/log/python.log:

2010-07-28 10:18:51,105 ERROR Sending email. subject="Splunk Results", results_link="None", recepients="['foo@bar.comm']"

I haven't been able to find any other errors related to this, and this is the only line in python.log.

I am using sendemail as follows:

my search terms | sendemail to=foo@bar.com sendresults=true

Windows Installation, 4.1.3. What am I doing wrong?

Accepted Answer

The sendemail command by default attempts to use localhost as the SMTP server and ignores the settings used for scheduled search alerts. If you do not have an SMTP server or forwarder installed (which on Windows is quite likely), sendemail will fail when trying to connect to localhost.

To work around this, specify server in sendemail as follows:

my search terms | sendemail to=foo@bar.com sendresults=true server=mail.bar.com

ERROR Sending email with sendemail, but alert emails work fine

Follow this question

Splunk Resources

Related questions