Sending Email Alerts from Windows Splunk

[npatellis]

I am trying to get alerting to send emails from our Windows 2008 (4.1.6 splunk) server. The email server is an open relay, yet splunk does not send the email. I believe the problem is with Windows not having an email client or forwarder.

Can someone provide some guidance on this? If I need a client, what is the recommendation?

Thanks

[au_chrismor]

Yes. It needs to be an SMTP service (we're using Lotus Domino) and it needs to be in the "mail host" field. I would recommend that you configure the SMTP box to require authentication or have some restrictive sending rules in place to prevent it from being abused.

If you need it, I can post shots of my Splunk settings for you

[jeffrolc]

I'm having this same problem. Should the mail server that is set to relay be in the "mail host" box?

[Ant1D]

Hi,

You will need an email client (I.e. A server that sends out emails)

In Manager » System settings » Email alert settings, you will need to specify the host address of this email client to send out email alerts on behalf of your Splunk instance.

[jeffrolc]

When you say "email client" what exactly are you referring to, a client like outlook or a mail server as an open relay?

[Ant1D]

My understanding is that Splunk expects an email client to do the email sending. The emails will contain the results data from a scheduled search that triggered the alert.

[npatellis]

That is configured. Maybe the question is more of does Splunk form and sent the emails to the email server or does it expect an underlying email client to do the sending?