Reporting

How do I configure email settings on a search head (SH) cluster?

pfabrizi
Path Finder

I have 3 search heads in a cluster and I need to configure email settings. I don't see server settings in the settings drop down on any of the search heads, only on the deployer. When I configure it on the deployer, it is dropped in the etc/system/local.

Can I just move that file to each search head or should I have an email app on the deployer and push from there?

Thanks!

0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @pfabrizi,

You can achieve it both the ways, put configuration file on $SPLUNK_HOME/etc/system/local/ on every Search Heads but this will be hectic when you have more Search Head in Cluster so in this case put alert_actions.conf on dedicated app or any other customized app in which you have other Search Head configuration on Deployer and push it to Search Heads.

View solution in original post

harsmarvania57
Ultra Champion

Hi @pfabrizi,

You can achieve it both the ways, put configuration file on $SPLUNK_HOME/etc/system/local/ on every Search Heads but this will be hectic when you have more Search Head in Cluster so in this case put alert_actions.conf on dedicated app or any other customized app in which you have other Search Head configuration on Deployer and push it to Search Heads.

pfabrizi
Path Finder

awesome, Thank You!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...