I have gotten alerts to work in Splunk, and they send e-mails. But, unfortunately, there is no Date: field among the e-mail headers.
Almost all other e-mails I get have this Date: field, and it is used to sort them. Without a date, the alerts get sorted to the wrong end of my e-mails, which is not helpful.
I have looked at python.log, and don't notice anything.
What might be wrong?
Well, I fixed this myself, by editing splunk/etc/apps/search/bin/sendemail.py.
About line 17, before TIMEOUT=600, I added the line:
from time import strftime, gmtime, time
About line 145, before the comment # Clear leading / trailing whitespace ... I added the line:
message ['Date'] = strftime ("%a, %d %b %Y %H:%M:%S", gmtime (time()))
That seems to work -- now I just have to remember to make a similar change to any update of Splunk.