https://community.splunk.com/t5/Alerting/Email-alert-changes/m-p/483673#M12737 <P>have a look in <CODE>index=_internal source=*python.log*</CODE> there you can have a look at the <STRONG>subject</STRONG> field that shows the alert name and the <STRONG>recipients</STRONG> filed shows the list of email ids.<BR /> you can compare by dunning the search over different times and see the difference in the recipients to find out which email ids were changed.</P> Thu, 16 Jan 2020 11:17:44 GMT soumyasaha25 2020-01-16T11:17:44Z https://community.splunk.com/t5/Alerting/Email-alert-changes/m-p/483672#M12736 <P>Hi,</P> <P>In our environment, email ID in the TO field has changed for one of the alerts.</P> <P>How to know when the email ID has changed. What was the previous email ID. Will this be logged in any log file.</P> <P>Pratapa</P> Thu, 16 Jan 2020 06:38:08 GMT https://community.splunk.com/t5/Alerting/Email-alert-changes/m-p/483672#M12736 pratapa 2020-01-16T06:38:08Z https://community.splunk.com/t5/Alerting/Email-alert-changes/m-p/483673#M12737 <P>have a look in <CODE>index=_internal source=*python.log*</CODE> there you can have a look at the <STRONG>subject</STRONG> field that shows the alert name and the <STRONG>recipients</STRONG> filed shows the list of email ids.<BR /> you can compare by dunning the search over different times and see the difference in the recipients to find out which email ids were changed.</P> Thu, 16 Jan 2020 11:17:44 GMT https://community.splunk.com/t5/Alerting/Email-alert-changes/m-p/483673#M12737 soumyasaha25 2020-01-16T11:17:44Z