How to find out the SMTP Splunk server?

Loves-to-Learn Everything

Splunk Settings.png

Hello Community.

Can you please advise me. Where in the configuration can I find out which SMTP mail server my Splunk uses to send notifications to employees? My configuration uses Search Head Cluster.
I'm trying to find the configuration file where my company's SMTP is listed through which it can send alerts within our domain.
I went to one of the Search Head and wanted to see the configuration at Settings/Server settings/Email settings. But there are no settings listed there. But this Search Head is sending alerts. Thank you for your feedback

Labels (1)
0 Karma


Hi @igor04653,

It seems Splunk is using your Linux server sendmail to send an email. It may work if you are sending only internal company mail addresses. 

If this reply helps you an upvote is appreciated.
0 Karma

Ultra Champion

I'm not sure how the web interface behaves with search-head clustering in this case but the email settings are configured in alert_actions.conf in [email] stanza.

Of course since you have clustered search-head environment, the settings are most probably deployed via an app deployed from the deployer. You should probably look there.

You can also just log on onto one of your search-heads and run

/opt/splunk/bin/splunk btool alert_actions list email

To see effective config. You can also add --debug switch to see which file the setting comes from.

You're interested in the "mailserver" key

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...