Why does my Email Allowed Domain List in Alert Actions not show up in SplunkWeb?

[BlueSocket]

I just upgraded to 9.4 and I got the new 9.3+ warning in SplunkWeb about the alert_actions.conf allowedDomainList setting not being set and that I should fix it.

I have now set the list correctly in an app and deployed the app to machine:

/opt/splunk/etc/apps/my_app/local/alert_action.conf

[email]

allowedDomainList = mydomain.com,myotherdomain.com

I then restart Splunk and I get no warnings. I then run the command:

/opt/splunk/bin/splunk cmd btool alert_actions list email

I see the following:

[email]

allowedDomainList = mydomain.com,myotherdomain.com

I then go into SplunkWeb and I do not see the allowedDomainList warning in the messages list - the issue is fixed.

I then go into Settings->Server Settings->Email Domains->Allowed Domains and this setting is empty. I would expect to see "mydomain.com,myotherdomain.com" in the setting control.

Even when I have set everything correctly and Splunk Btool shows the right setting and I have restarted Splunk , why is the setting not showing up?

[BlueSocket]

*SIGH* I guessed that this might be the reason. It is just annoying that the settings from other apps are shown in part of the settings, but not this one.

[livehybrid · Accepted solution]

Hi @BlueSocket 

The Splunk Web UI under Settings -> Server Settings -> Email Domains -> Allowed Domains specifically reads from and writes to the global configuration file located at $SPLUNK_HOME/etc/system/local/alert_actions.conf.

Since you configured allowedDomainList within an app context ($SPLUNK_HOME/etc/apps/my_app/local/alert_actions.conf), Splunk correctly applies this setting during its configuration layering process. This is why btool shows the setting as active and the warning message in Splunk Web disappears.

However, the UI page itself is designed only to display and manage the setting present in the system/local directory. It does not reflect settings inherited from app-level configurations. Your configuration is active and enforced, but it won't appear on that specific UI page unless you define it globally in $SPLUNK_HOME/etc/system/local/alert_actions.conf.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing