How to find out the SMTP Splunk server?

Loves-to-Learn Everything

Splunk Settings.png

Hello Community.

Can you please advise me. Where in the configuration can I find out which SMTP mail server my Splunk uses to send notifications to employees? My configuration uses Search Head Cluster.
I'm trying to find the configuration file where my company's SMTP is listed through which it can send alerts within our domain.
I went to one of the Search Head and wanted to see the configuration at Settings/Server settings/Email settings. But there are no settings listed there. But this Search Head is sending alerts. Thank you for your feedback

Labels (1)
0 Karma


Hi @igor04653,

It seems Splunk is using your Linux server sendmail to send an email. It may work if you are sending only internal company mail addresses. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma


I'm not sure how the web interface behaves with search-head clustering in this case but the email settings are configured in alert_actions.conf in [email] stanza.

Of course since you have clustered search-head environment, the settings are most probably deployed via an app deployed from the deployer. You should probably look there.

You can also just log on onto one of your search-heads and run

/opt/splunk/bin/splunk btool alert_actions list email

To see effective config. You can also add --debug switch to see which file the setting comes from.

You're interested in the "mailserver" key

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...