topic Re: How to find out the SMTP Splunk server in Alerting

How to find out the SMTP Splunk server?

igor04653 — Tue, 20 Sep 2022 14:40:06 GMT

Splunk Settings.png

Hello Community.

Can you please advise me. Where in the configuration can I find out which SMTP mail server my Splunk uses to send notifications to employees? My configuration uses Search Head Cluster.
I'm trying to find the configuration file where my company's SMTP is listed through which it can send alerts within our domain.
I went to one of the Search Head and wanted to see the configuration at Settings/Server settings/Email settings. But there are no settings listed there. But this Search Head is sending alerts. Thank you for your feedback

Re: How to find out the SMTP Splunk server

PickleRick — Tue, 20 Sep 2022 08:17:36 GMT

I'm not sure how the web interface behaves with search-head clustering in this case but the email settings are configured in alert_actions.conf in [email] stanza.

Of course since you have clustered search-head environment, the settings are most probably deployed via an app deployed from the deployer. You should probably look there.

You can also just log on onto one of your search-heads and run

/opt/splunk/bin/splunk btool alert_actions list email

To see effective config. You can also add --debug switch to see which file the setting comes from.

You're interested in the "mailserver" key

Re: How to find out the SMTP Splunk server

scelikok — Tue, 20 Sep 2022 08:33:18 GMT

Hi @igor04653,

It seems Splunk is using your Linux server sendmail to send an email. It may work if you are sending only internal company mail addresses.