Reporting on splunk 9.21 and redhat9 not creating from field correctly


We upgraded our red hat 7 to 9 this past monday.
and splunk stopped sending emails.
We were inexperience and unprepare for this so we upgraded our splunk enterprise from 9.1 to 9.13 to see if this would fix it.
It did not.
then we upgraded to 9.2, that did not fix it.
I started adding debug mode to everything and found that splunk would send the emails to postfix and the postfix logs would state the emails were send.
however, after looking at it closer, I notice the from field of the splunk sendemail generated emails had the from field like:
(as they used to before we upgraded to redhat 9

When we use mailx, the fron field from field is constructed correctly such as:

extra python debugging does not show the from field but only the user and the domain:
from': 'splunk', 'hostname': '',

My stanza in /opt/splunk/etc/system/local/alert_action.conf:
hostname =

Does anyone know how to fix this?
Is there a setting in splunk that would make sure the email from field is constructed correctly.
It is funny that if you add an incorrect "to" address splunk whines but if splunk create a incorrect to field address in sendemail, it is fine and, just send it to postfix and let it handle it, lol dandy 🙂


Labels (1)
0 Karma


From your description, it seems like the upgrade of RH from 7 to 9 has disrupted Splunk's assumptions about the full DNS name. 

You could try being more specific in the configuration files until Splunk starts sending emails properly. E.g. you could set the from= field in alert_action.conf to be a full email address so that Splunk does not have to figure out the hostname to tack on with the ampersand.
NOTE:  alert_actions.conf is plural (alert_actions, not alert_action) 

from =

You could also try a direct sendemail command:

| sendemail from="" to="" subject="Test Email"

If you have different emails per alert, you could edit the alert in the Advanced Settings to explicitly set the from= field to a full email address.

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...