I'm trying to schedule an alert system that notifies individuals on a daily basis based on a trigger. However, I haven't received any emails from my Splunk instance which is in a VM and I don't know how to debug it. My search query is: `
host=jenniferleeVM | 'IS_EXPIRED' | where expirationStatus="expired" `
where IS_EXPIRED is a macro that creates a field, expirationStatus with "expired" and "active" as potential outcomes. The host is set to localhost.
Is there a way to fix this? Or can Splunk instances installed in a VM not email alert notifications?
You can send email alerts from a VM. You will need to configure your outbound SMTP server properly thought.
Read Here : http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/Emailnotification#Configure_email_notificati...
How do I configure the outbound SMTP server through the email configuration settings? I used this site (http://blogs.splunk.com/2014/01/31/testing-alerts-using-local-smtp-server/) to test my alert notification system but it didn't work.