Getting Data In

Sending Email Alerts from Windows Splunk

npatellis
Explorer

I am trying to get alerting to send emails from our Windows 2008 (4.1.6 splunk) server. The email server is an open relay, yet splunk does not send the email. I believe the problem is with Windows not having an email client or forwarder.

Can someone provide some guidance on this? If I need a client, what is the recommendation?

Thanks

Tags (2)
0 Karma

au_chrismor
Explorer

Yes. It needs to be an SMTP service (we're using Lotus Domino) and it needs to be in the "mail host" field. I would recommend that you configure the SMTP box to require authentication or have some restrictive sending rules in place to prevent it from being abused.

If you need it, I can post shots of my Splunk settings for you

0 Karma

jeffrolc
New Member

I'm having this same problem. Should the mail server that is set to relay be in the "mail host" box?

0 Karma

Ant1D
Motivator

Hi,

You will need an email client (I.e. A server that sends out emails)

In Manager » System settings » Email alert settings, you will need to specify the host address of this email client to send out email alerts on behalf of your Splunk instance.

0 Karma

jeffrolc
New Member

When you say "email client" what exactly are you referring to, a client like outlook or a mail server as an open relay?

0 Karma

Ant1D
Motivator

My understanding is that Splunk expects an email client to do the email sending. The emails will contain the results data from a scheduled search that triggered the alert.

0 Karma

npatellis
Explorer

That is configured. Maybe the question is more of does Splunk form and sent the emails to the email server or does it expect an underlying email client to do the sending?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...