How to do Splunk Email Configuration?

boydtc — Thu, 07 Jul 2022 16:56:09 GMT

Good day,

We have an issue where when we try to setup email notifications with our email server with Splunk, no emails will send to the respective email addresses. We tried adding the adding the information: "ipaddress:port" to the mail host section but no luck. We do not require a username and password. We also tried following the instructions from the documentation here:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sendemail

There was no luck there either. Is there an alternative way to setup email notifications through SSH or something else? This has to satisfy a STIG requirement.

Please let me know if I need to provide additional information to the forum.

Thank you

Re: Splunk Email Configuration

richgalloway — Thu, 07 Jul 2022 14:59:46 GMT

Check splunkd.log for messages relating to "sendemail". They should explain why Splunk was unable to send the email or confirm the messages were handed off to the email service. If the latter then the problem should be taken up with the email admin.

Do you have the correct SMTP server configured (Settings->Server settings->Email settings)?

topic How to do Splunk Email Configuration? in Splunk Enterprise

How to do Splunk Email Configuration?

Re: Splunk Email Configuration