Unable to send email (Trigger action) for an alert in splunk.

Applicability

Splunk Enterprise

Description

When setting the "send email" in trigger actions for Splunk alerts there were several errors showing up:

ERROR sendemail:392 - createSSLContextFromSettings() got an unexpected keyword argument 'confJSON' while sending mail to: admin@splunk.com.

After trying with the "sendemail to" with the same recipient it did not work either.


 

Investigation

While doing research found that there was a change on the Splunk sendemail python script when upgrading Splunk from version  6.3.3 to version 6.5.x or higher (in this case it was version 7.1.0).

Resolution

In older versions that script had this lines included:
 

# setup the Open SSL Context
          sslHelper = ssl_context.SSLHelper()
      # Pass in settings from alert_actions.conf into context
         ctx = sslHelper.createSSLContextFromSettings(
         confJSON=ssContent.get('alertActions'),
         sessionKey=sessionKey,
         isClientContext=True)

however, it should contain the newest lines  
 

# setup the Open SSL Context
        sslHelper = ssl_context.SSLHelper()
        serverConfJSON = sslHelper.getServerSettings(sessionKey)
        # Pass in settings from alert_actions.conf into context
        ctx = sslHelper.createSSLContextFromSettings(
            sslConfJSON=ssContent.get('alertActions'),
            serverConfJSON=serverConfJSON,
            isClientContext=True).

Once the script is updated, it will start working.

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release