Reporting
Highlighted

Can we configure Splunk to use multiple senders in an email alert?

Path Finder

As per my understanding, Splunk can only send an alert from 1 sender that configured in the Email Setting.

I need to know if we can configure Splunk to use multiple senders?

0 Karma
Highlighted

Re: Can we configure Splunk to use multiple senders in an email alert?

SplunkTrust
SplunkTrust

@vumanhtai,

You may try using the sendemail command where you can mention the [from=]

sendemail to=<email_list>

[from=<email_list>]
[cc=<email_list>]
[bcc=<email_list>]
[subject=<string>]
[format=csv | table | raw]
[inline= <bool>]
[sendresults=<bool>]
[sendpdf=<bool>]

Or
Try adding them in savedsearches.conf

action.email.from = <email address>
* Set an email address to use as the sender's address.
* Defaults to splunk@<LOCALHOST> (or whatever is set in alert_actions.conf).

View solution in original post

0 Karma
Highlighted

Re: Can we configure Splunk to use multiple senders in an email alert?

Path Finder

I tried using the sendemail command but I didn't see the password entry field for the email sent

0 Karma
Highlighted

Re: Can we configure Splunk to use multiple senders in an email alert?

SplunkTrust
SplunkTrust

Do you mean you want to set the username/password for the server authentication during sendmail ? If yes, then username= and password= should work though they are not mentioned in the doc.

def mail(email, argvals, ssContent, sessionKey):

    sender     = email['From']
    use_ssl    = normalizeBoolean(ssContent.get('action.email.use_ssl', False))
    use_tls    = normalizeBoolean(ssContent.get('action.email.use_tls', False))
    server     = ssContent.get('action.email.mailserver', 'localhost')

    username   = argvals.get('username', '')
    password   = argvals.get('password', '')
0 Karma
Highlighted

Re: Can we configure Splunk to use multiple senders in an email alert?

Path Finder

oh! thank you so much

0 Karma
Highlighted

Re: Can we configure Splunk to use multiple senders in an email alert?

Path Finder

Hi renjith.nair !
sourcetye=error | stats count by email | sendmail to=....

I want the receiver in "sendmail" is the result of query "stats count by email"
For example:
If we have 3 emails from the "stats count by email"
Then the query "sendmail" will send email to the 3 above emails.

Thanks in advance!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.