topic Re: Email alert not triggering in Splunk Enterprise Security

Email alert not triggering

maheshnc — Wed, 12 Nov 2025 12:49:34 GMT

Hello, we have a DMC configured on Splunk Licence Master, I need to enable all the critical resource utilization alerts on DMC and send email notifications. I have configured the server setting under settings>server setting>Email settings and set up the same configurations as on our search head (which is successfuly generating email notifications) but the thing is, alerts are triggering but but I am not receiving any email notifications. can somebody help me to figure out the root cause?

Note: Network connectivity established between mail server and LM server.

Re: Email alert not triggering

VatsalJagani — Sat, 15 Nov 2025 08:58:49 GMT

@maheshnc - Search for internal logs to understand and troubleshoot the issue further.

index=_internal NOT source=*_access* "<title of the alert>"

And see what logs tell you.

I hope this helps!!! Kindly upvote!!!

Re: Email alert not triggering

PickleRick — Sat, 15 Nov 2025 14:52:41 GMT

Or specifically - if the alert _is_ being triggered but there is a problem with email delivery, search for anything regarding sendemail.py

Re: Email alert not triggering

maheshnc — Mon, 17 Nov 2025 11:58:33 GMT

Getting this error, not sure why

Re: Email alert not triggering

PickleRick — Mon, 17 Nov 2025 17:01:46 GMT

Well... this is something that should be troubleshot with your email admins because there is apparently something wrong with your Splunk trying to authenticate to the email server.

Re: Email alert not triggering

SK99 — Tue, 18 Nov 2025 09:05:00 GMT

@maheshnc , you might need to enable email relay from your DMC/LM server to Email server in order to send internal emails (as per your organizational policies.)

Re: Email alert not triggering

PickleRick — Tue, 18 Nov 2025 19:56:52 GMT

I don't think you can "enable forwarding" on outlook com. You need to properly authenticate.

Re: Email alert not triggering

SK99 — Wed, 19 Nov 2025 04:25:51 GMT

Yes, with email relay there is option for "IP address authentication"; means to authorize a specific server's IP address to send email through the relay service.

Re: Email alert not triggering

PickleRick — Wed, 19 Nov 2025 07:26:01 GMT

Interesting. Didn't expect that. But be aware that since you're most probably not using static public IPs on your Splunk components you'd be opening relaying from whatever is NAT-ed to the same IP.