Alerting

I've some customized setting in alert_actions.conf within an app, how can I make this global and apply to other apps also?

daniel_splunk
Splunk Employee
Splunk Employee

I've make this alert configuration
$SPLUNK_HOME/etc/apps/My_config/local/alert_actions.conf
[email]
auth_password =
auth_username =
from = splunk.test
hostname = 10.1.1.1
mailserver = smtp.mytesting.com:465
use_ssl = 1
use_tls = 0
footer.text = My tailor-made footer

Upon testing, only saved searches under My_config app be able to use this configration. Saved search in other apps cannot use this configuration.

Tags (3)
0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

By default, alert_actions.conf scope to its own app.

Add the following stanza and you should be able to make it global.

Go to $SPLUNK_HOME/etc/apps/My_config/metadata/local.meta
[alert_actions/email]
version = 6.2.0
export = system

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...