Is there a way to send email notifications to all members of an Active Directory group at once?

[mawomommoh]

When setting up an alert, for 'Send email' Trigger actions, is there a way to send emails to all members of an Active Directory group at once when filling out the 'To' field? Must I manually enter emails into the 'To' field or there is a way to setup sending to a list of emails?

[xpac · Accepted solution]

Such a feature must be implemented on the mail server - Splunk simply sends the alert to wherever it's told to.
You should therefore check with your AD/Exchange admin - I know such groups/mailboxes can be setup, because we send to such a group. 😉

Hope that helps!

[mawomommoh]

Thanks for the feedback @xpac . So from what you stated I presume the 'TO' field will contain the address of the AD group. I know Splunk has 'Email settings'. Do you know if any configurations are to be made there or it's mainly to be setup from the AD/Exchange side of things?

[xpac]

It's only the AD/Exchange side. Mail (SMTP) is a pretty simple protocol (some would say stupid ;-)).
So, the sending side knows literally nothing about the receiver, if it's a single user, a group, a mailbox, if it exists - it just takes the mail, contacts the mailserver for @yourdomain.tld and says "Here, deal with this mail". So - have your AD/Exchange people set up a distribution list, tell Splunk to send the mail to whatever email address your AD/Exchange people give you, and you're good.

[mawomommoh]

Great! Thanks for the insightful explanation. Much appreciated. 🙂