How to get a list of all emails sent out by Splunk and all associated reports and alerts?

[Jerseyguy22]

Our Splunk server sends out dozens of emails every day. I want to find out the list of all the emails that are sent out by Splunk and associated jobs (whether alerts or reports) that are configured by all users. (I have admin rights on the Splunk server.)

Where exactly in Splunk Web do I see this information?

[kbarker302 · Accepted solution]

The Python and splunkd logs would be the place to start. You can run the following query to get e-mail related activity:

index=_internal source="C:\\Program Files\\Splunk\\var\\log\\splunk\\python.log" sendemail

If you run the same search but with splunkd.log instead, there's a field called ssname that gives the search that triggered the alert.

[lakromani]

On linux that would be:

index=_internal source="/opt/splunk/var/log/splunk/python.log" sendemail

[pretzel2]

This is very helpful. But I need to scrub savesearches.conf for any scheduled search with an email alert action and provide a report, so we can show and eventually update email addresses. Each stanza in savedsearches.conf can be different. It would be great to have a configurable view of savedsearches.conf with output to csv. This sounds like a feature request for splunk or a series of scripts.