Alerting

Alert Actions: How to set alert.email.from value dynamically based on host?

koshyk
Super Champion

As per Splunk documentation for savedsearches.conf the action.email.from can be set to ensure the "From" address is filled up.
The default value in alert_actions.conf from is splunk when i run the btool.

How to change this to splunk@$LOCALHOST ? (though document says it is the default, in reality it is just "splunk")
When i put the value as splunk@$LOCALHOST it throws error as "Invalid Address" in python.log

(OR any REST interface for this?)

Same issue exists on Splunk 6.4.x,6.5.x,6.6.x

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @koshyk,

If you look at $SPLUNK_HOME/etc/system/default/alert_actions.conf, it is saying that hostname will be automatically appended from mailserver

# from email address (name only, host will be appended automatically from mailserver)

from=splunk
0 Karma

koshyk
Super Champion

hi mate, as mentioned in my question.. though doc says like that, host is not getting appending automatically

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Can you please let us know what value are you getting in From in your mailbox when Email alert has been fired ? Additionally how you configured splunk to send email alert ?

In my lab environment I didn't configured Email Settings in Splunk so by default it use localhost as mailserver (Config in alert_actions.conf mailserver = localhost) and on server postfix is running as mailserver so splunk use postfix to send email alert. Now in postfix it captures hostname from myhostname parameter in /etc/postfix/main.cf, if you do not set anything then it will use Linux function gethostname() to set myhostname parameter. If I specifically set myhostname = test.example.com then splunk will send alert (with default configuration) with from field as splunk@test.example.com so you need to check on your mailserver what hostname it is providing.

0 Karma

koshyk
Super Champion

it just comes as "splunk" (with no hostname)
hostname is set and I can see the JIRA addon sends email correctly. It is the default splunk alert which has the issue

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...