Send e-mail through Splunk search Alert "command="sendemail", 'rootCAPath'" but no where to add ROLE?

[anonymous_hippo]

I'm trying send an e-mail from my Splunk Search Alert (I am using SPLUNK Enterprise), but I'm getting an error message "command="sendemail", 'rootCAPath' while sending mail to: MySuperCoolEmail101@gmail.com" and when I try a solution that involves going to Settings to Add a Role, I don't see that option listed at all.

My search query is something like (reference https://community.splunk.com/t5/Reporting/How-to-get-Splunk-sendemail-command-to-send-multiple-email...)

index=rtm source="/mypath/app.log" SomeRandomTextHereForTesting | sendemail to="MySuperCoolEmail101@gmail.com" format=raw subject=myresults server=mail.splunk.com sendresults=true

I found this post which suggests adding some "list_settings" role by going to Settings > Access Controls > Roles, but I do not seem to have that option (reference https://community.splunk.com/t5/Reporting/splunk-dashboard-cant-sent-email/m-p/489388)

Am I doing something wrong? Is this because I'm on Splunk Enterprise? Am I using the correct mail server? How do I add ROLES?

[PickleRick]

To define roles (add capabilities to a role) you have to be an admin.

[anonymous_hippo]

@PickleRick Is there anyway else to send an Email through splunk based on my Search Alert result? or am I blocked unless I can add this role? (I will keep seeing this rootCAPath error?

I tried EDITING the alert itself, and it has some "ACTIONS" like integration with PagerDuty, which works just fine for me (tested), and there is an EMAIL trigger also, however, when I write my email, nothing ever gets sent to it. That's why I was trying to above "sendemail" function. 

I also needed to include some of the dynamic information in the Search Results Alert into my EMAIL, hopefully this is easily feasible?

Thank you for your help thus far.

[PickleRick]

Well, you can have an action "send email" in alert definition but the email settings for your Splunk Enterprise instance must be specified by the admin. If your Splunk instance was not configured for sending email, it's either an ommision by the admin or a deliberate choice not to use this functionality. Either way - you should consult your Splunk admin about this.

And it's overally a good idea - a normal user shouldn't be able to (ab)use email sending functionality by trying to send emails via random servers.

[anonymous_hippo]

Hi, @PickleRick thanks for the help thus far. I reached out to my administrators today and found out I actually indeed do have ADMIN have for this splunk (enterprise).

Am I missing something here? Am I looking at the right spot (based on my first/initial screen shot I posted) for adding a Role, and is this even the correct approach I am taking?

I simply want to send an email through splunk alert.....

[PickleRick]

Well, that's strange because as an admin you should have additional entries in Settings dialog. Especially the links to manage roles and users.

See for yourself:

https://docs.splunk.com/Documentation/Splunk/8.2.2/Search/NavigatingSplunkWeb

Look at the screenshot of the Settings menu.

In a larger (not all-in-one) environment some settings might not be available but the ones we're talking about should definitely be there (for an admin).

Properly, you should have your email sending mechanism configured under Alert Actions.

Then when defining alert you only need to chose the defined Alert Action.