Is there a way (apart from editing sendemail.py) to change the default server that sendemail uses?
sendemail.py
sendemail
A glance at sendemail.py suggests not...
On the Search Head: Settings -> Server settings -> Email settings.
Settings
Server settings
Email settings
That works for saved searches.
Doesn't work for searches from the command line.
There is an entry for Mail host under System settings >> Email alert settings >> Mail host
Why this isn't also applicable to sendemail is a mystery to me. Feels like a bug.
Because it could be over written by a Splunk update without telling you and by going @woodcock 's way you configure the setting persistent in alert_actions.conf
alert_actions.conf
