Alerting

I've some customized setting in alert_actions.conf within an app, how can I make this global and apply to other apps also?

daniel_splunk
Splunk Employee
Splunk Employee

I've make this alert configuration
$SPLUNK_HOME/etc/apps/My_config/local/alert_actions.conf
[email]
auth_password =
auth_username =
from = splunk.test
hostname = 10.1.1.1
mailserver = smtp.mytesting.com:465
use_ssl = 1
use_tls = 0
footer.text = My tailor-made footer

Upon testing, only saved searches under My_config app be able to use this configration. Saved search in other apps cannot use this configuration.

Tags (3)
0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

By default, alert_actions.conf scope to its own app.

Add the following stanza and you should be able to make it global.

Go to $SPLUNK_HOME/etc/apps/My_config/metadata/local.meta
[alert_actions/email]
version = 6.2.0
export = system

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...