topic Re: Alert Actions: How to set alert.email.from value dynamically based on host? in Alerting

Alert Actions: How to set alert.email.from value dynamically based on host?

koshyk — Mon, 29 Oct 2018 13:12:25 GMT

As per Splunk documentation for savedsearches.conf the action.email.from can be set to ensure the "From" address is filled up.
The default value in alert_actions.conf from is splunk when i run the btool.

How to change this to splunk@$LOCALHOST ? (though document says it is the default, in reality it is just "splunk")
When i put the value as splunk@$LOCALHOST it throws error as "Invalid Address" in python.log

(OR any REST interface for this?)

Same issue exists on Splunk 6.4.x,6.5.x,6.6.x

Re: Alert Actions: How to set alert.email.from value dynamically based on host?

harsmarvania57 — Mon, 29 Oct 2018 14:13:24 GMT

Hi @koshyk,

If you look at $SPLUNK_HOME/etc/system/default/alert_actions.conf, it is saying that hostname will be automatically appended from mailserver

# from email address (name only, host will be appended automatically from mailserver)

from=splunk

Re: Alert Actions: How to set alert.email.from value dynamically based on host?

koshyk — Tue, 30 Oct 2018 22:42:28 GMT

hi mate, as mentioned in my question.. though doc says like that, host is not getting appending automatically

Re: Alert Actions: How to set alert.email.from value dynamically based on host?

harsmarvania57 — Wed, 31 Oct 2018 11:06:07 GMT

Can you please let us know what value are you getting in From in your mailbox when Email alert has been fired ? Additionally how you configured splunk to send email alert ?

In my lab environment I didn't configured Email Settings in Splunk so by default it use localhost as mailserver (Config in alert_actions.conf mailserver = localhost) and on server postfix is running as mailserver so splunk use postfix to send email alert. Now in postfix it captures hostname from myhostname parameter in /etc/postfix/main.cf, if you do not set anything then it will use Linux function gethostname() to set myhostname parameter. If I specifically set myhostname = test.example.com then splunk will send alert (with default configuration) with from field as splunk@test.example.com so you need to check on your mailserver what hostname it is providing.

Re: Alert Actions: How to set alert.email.from value dynamically based on host?

koshyk — Wed, 31 Oct 2018 12:55:31 GMT

it just comes as "splunk" (with no hostname)
hostname is set and I can see the JIRA addon sends email correctly. It is the default splunk alert which has the issue