topic Re: Custom Email From Address for Alerts in Alerting

Custom Email From Address for Alerts

griggsy — Mon, 16 Jul 2018 08:22:40 GMT

Hello,

I have an alert setup that I would like to send to end users however I want to change the from address in the email alert. Are you able to change the from field for specific alerts?

Ta.
Pete.

Re: Custom Email From Address for Alerts

renjith_nair — Mon, 16 Jul 2018 08:36:40 GMT

Hi @griggsy ,

You could change the From email address in Mail Server Settings in Email Settings : http://docs.splunk.com/Documentation/SplunkCloud/7.0.3/Alert/Emailnotification#Configure_email_notification_for_your_Splunk_instance

If you want to send each mail from a different "from" address, then probably sendemail command or a Configuring scripted alerts might be an option

Re: Custom Email From Address for Alerts

griggsy — Mon, 16 Jul 2018 11:38:04 GMT

Thanks, Just seems annoying you can't set the from address per alert.

Re: Custom Email From Address for Alerts

chrisboy68 — Fri, 24 Jul 2020 14:32:18 GMT

I know this a bit old, but I agree it would be great to have this open. It could default to the system from or we can default to the alert owner. Managing bounced email for over thousands of email alerts is cumbersome. Sending the bounce back to the alert owner and they can handle it.

Chris

Re: Custom Email From Address for Alerts

shivanshu1593 — Sun, 26 Jul 2020 12:03:53 GMT

For anyone looking how to do this for your report/alert already created:

1. Edit savedsearches.conf on your search head. Find the name of the alert, for which you want to use the new email address to send emails to the recipients and add the following:

action.email.from = your_email_address

action.email.mailserver = your_smtp_server_name

2. Restart Splunkd.

Works like a charm. The best part is that all of your other alerts will still use the default email address, supplied in the server settings of your search head. Hope this helps.