Getting Data In

Sending Email Alerts from Windows Splunk

npatellis
Explorer

I am trying to get alerting to send emails from our Windows 2008 (4.1.6 splunk) server. The email server is an open relay, yet splunk does not send the email. I believe the problem is with Windows not having an email client or forwarder.

Can someone provide some guidance on this? If I need a client, what is the recommendation?

Thanks

Tags (2)
0 Karma

au_chrismor
Explorer

Yes. It needs to be an SMTP service (we're using Lotus Domino) and it needs to be in the "mail host" field. I would recommend that you configure the SMTP box to require authentication or have some restrictive sending rules in place to prevent it from being abused.

If you need it, I can post shots of my Splunk settings for you

0 Karma

jeffrolc
New Member

I'm having this same problem. Should the mail server that is set to relay be in the "mail host" box?

0 Karma

Ant1D
Motivator

Hi,

You will need an email client (I.e. A server that sends out emails)

In Manager » System settings » Email alert settings, you will need to specify the host address of this email client to send out email alerts on behalf of your Splunk instance.

0 Karma

jeffrolc
New Member

When you say "email client" what exactly are you referring to, a client like outlook or a mail server as an open relay?

0 Karma

Ant1D
Motivator

My understanding is that Splunk expects an email client to do the email sending. The emails will contain the results data from a scheduled search that triggered the alert.

0 Karma

npatellis
Explorer

That is configured. Maybe the question is more of does Splunk form and sent the emails to the email server or does it expect an underlying email client to do the sending?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!