topic Re: Splunk Alerts being quarantined from invalid sender 0365 in Alerting

How to make changes from the GitLab server (not from Splunk Web) to track changes for a Splunk configuration file?

ngwodo — Fri, 25 Sep 2020 21:20:00 GMT

Splunk alerts are being quarantined from an invalid sender. What backend files need to be modified? How can I make changes from the GitLab server (not from Splunk Web) to track changes for a Splunk configuration file: savedsearches.conf for an invalid email sender?

Re: Splunk Alerts being quarantined from invalid sender 0365

thambisetty — Tue, 15 Sep 2020 14:25:39 GMT

can you elaborate you question?

Re: Splunk Alerts being quarantined from invalid sender 0365

ngwodo — Tue, 15 Sep 2020 16:01:14 GMT

I noticed a large number of Splunk alerts in the hosted O365 quarantine (not delivered) because they are using an invalid sender "From: splunk-s". This is not a problem with the tenant configuration where we can whitelist it. O365 needs to see a properly formatted “from” header, e.g. somebody@gmail.com. Is this something that can be adjusted in the Splunk config? It would also be beneficial to remove some of the old recipients from these alerts:

Re: Splunk Alerts being quarantined from invalid sender 0365

thambisetty — Tue, 15 Sep 2020 16:38:05 GMT

From the Search and Reporting app home page, select Settings > Server settings > Email settings.
Select Mail Server Settings.

you see from field, update from address there.

Re: Splunk Alerts being quarantined from invalid sender 0365

ngwodo — Tue, 15 Sep 2020 16:57:59 GMT

I am talking about doing it from Linux command line.

Re: Splunk Alerts being quarantined from invalid sender

ngwodo — Thu, 17 Sep 2020 15:35:18 GMT

Please can you tell how I can make changes from gitlab server to track changes for a Splunk configuration file: savedsearches.conf for an invalid email sender? Please I need the step by step process on how to do it. We need to do it from gitlab not from splunk web.