How to do Splunk Email Configuration?

[boydtc]

Good day,

We have an issue where when we try to setup email notifications with our email server with Splunk, no emails will send to the respective email addresses. We tried adding the adding the information: "ipaddress:port" to the mail host section but no luck. We do not require a username and password. We also tried following the instructions from the documentation here:

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Sendemail

There was no luck there either. Is there an alternative way to setup email notifications through SSH or something else? This has to satisfy a STIG requirement.

Please let me know if I need to provide additional information to the forum.

Thank you

[richgalloway]

Check splunkd.log for messages relating to "sendemail".  They should explain why Splunk was unable to send the email or confirm the messages were handed off to the email service.  If the latter then the problem should be taken up with the email admin.

Do you have the correct SMTP server configured (Settings->Server settings->Email settings)?