Dfyjkt

From /opt/splunk/var/log/splunk/python.log:

2018-11-12 14:29:08,776 +0000 ERROR sendemail:137 - Sending email. subject="Splunk Alert: Errors in develop", results_link="https://localhost:8000/app/search/@go?sid=rt_scheduler__admin__search__RMD58e26482826eced90_at_1542024571_26.426", recipients="[u'my_email@gmail.com']", server="localhost"
2018-11-12 14:29:08,776 +0000 ERROR sendemail:458 - [Errno 99] Cannot assign requested address while sending mail to: my_email@gmail.com

My /opt/splunk/etc/system/local/alert_actions.conf:

 [email]
 auth_password = XXX
 auth_username = my_email@gmail.com
 hostname = localhost
 mailserver = smtp.gmail.com:465
 pdf.header_left = none
 pdf.header_right = none
 use_ssl = 1

I also tried smtp.gmail.com:587 with use_ssl = 0 use_tls = 1, got same error in both cases.

However, when trying to send mail directly from search, it works as expected:

... | sendemail to="my_email@gmail.com" format=raw sendresults=1 footer="Sent from Splunk." from="SplunkAlerts" subject="Splunk Alert" message="The following Splunk Alert has been fired:"

what configuration am I missing? errno 99 is EADDRNOTAVAIL , not clear what is not available, is it the server="localhost" in the error log? where should I set it?

In your config, you need to use server=, not mailserver.

https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Sendemail

Please note that often Gmail will be finicky about trying to send email through it this way, and I tend to avoid it if possible. Do you have a local mail server configured?

For the meantime I'm using the following script as a workaround:

temp="/tmp/results_$(date -u +%s).csv"
gunzip < $8 > $temp
printf "$1 alarming logs were found by $4n$6" | 
 SMTP_URL='smtps://my_email%40gmail.com:password@smtp.gmail.com' mutt 
 -F /dev/null 
 -e 'set from="Splunk <my_email@gmail.com>"' 
 -e 'set smtp_url=$SMTP_URL' 
 -s "Splunk: $4" 
 -a $temp -- 
 target@gmail.com
rm -rf $temp

at $SPLUNK_HOME/bin/scripts/sendmail.sh