Reporting on splunk 9.21 and redhat9 not creating from field correctly


We upgraded our red hat 7 to 9 this past monday.
and splunk stopped sending emails.
We were inexperience and unprepare for this so we upgraded our splunk enterprise from 9.1 to 9.13 to see if this would fix it.
It did not.
then we upgraded to 9.2, that did not fix it.
I started adding debug mode to everything and found that splunk would send the emails to postfix and the postfix logs would state the emails were send.
however, after looking at it closer, I notice the from field of the splunk sendemail generated emails had the from field like:
(as they used to before we upgraded to redhat 9

When we use mailx, the fron field from field is constructed correctly such as:

extra python debugging does not show the from field but only the user and the domain:
from': 'splunk', 'hostname': '',

My stanza in /opt/splunk/etc/system/local/alert_action.conf:
hostname =

Does anyone know how to fix this?
Is there a setting in splunk that would make sure the email from field is constructed correctly.
It is funny that if you add an incorrect "to" address splunk whines but if splunk create a incorrect to field address in sendemail, it is fine and, just send it to postfix and let it handle it, lol dandy 🙂


Labels (1)
0 Karma


From your description, it seems like the upgrade of RH from 7 to 9 has disrupted Splunk's assumptions about the full DNS name. 

You could try being more specific in the configuration files until Splunk starts sending emails properly. E.g. you could set the from= field in alert_action.conf to be a full email address so that Splunk does not have to figure out the hostname to tack on with the ampersand.
NOTE:  alert_actions.conf is plural (alert_actions, not alert_action) 

from =

You could also try a direct sendemail command:

| sendemail from="" to="" subject="Test Email"

If you have different emails per alert, you could edit the alert in the Advanced Settings to explicitly set the from= field to a full email address.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...