- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- How to check permissions required to send an alert
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
following up on https://answers.splunk.com/answers/808200/splunk-alerts-not-sending-e-mail.html?childToView=810356#a....
I wanted to figure out if there were any permissions needed to enable a splunk alert from my account. Is there a way I can check the permissions needed to create a working splunk alert (that sends out an email)?
Not sure if i'm providing enough information, so please let me know if i need to provide more.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need below capabilities set to user role under which alert are triggered.
schedule_search = enabled
list_settings = enabled
admin_all_objects = enabled (This capability is required if the mail host requires login credentials. It is for PDF mail delivery only.)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need below capabilities set to user role under which alert are triggered.
schedule_search = enabled
list_settings = enabled
admin_all_objects = enabled (This capability is required if the mail host requires login credentials. It is for PDF mail delivery only.)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe this worked, thank you!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@golcondar ,
Sometime email ID would have an issue with exchange servers which does not allow to recieve any emails.
Just my 2 cents here :
try adding - @exchange.domain.com
For xample - First.lastname@exchange.org.com , where org could be your organizational name
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
