How can I find out which email server Splunk uses?

[ddrillic]

Where can I find which email server Splunk uses? An advanced user is asking ; - )

[MuS]

Hi dddillic,

If you want to see the config for the mail server you can use either of these commands:

|  rest /services/configs/conf-alert_actions/email 
|  table mailserver

or

$SPLUNK_HOME/splunk btool alert_actions list email

and look for the mailserver option.

Hope this helps ...

cheers, MuS

[ddrillic]

Perfect. It's all localhost -

[treinke · Accepted solution]

If you have access to your internal index. You can try the following:

index=_internal source="*/python.log" "Sending email"

You should see a field called server.

server="localhost"

[jaihingorani]

what is behind localhost ? is it the relayhost which is setup under postfix configuration ?

[ddrillic]

Thank you!