Splunk Search

Smtp email to send alerts

manekar
New Member

Hi,
Can you please how to to create a alert and send email using smtp server.
We have two seperate host s for indexer and search head.

Thanks,

Tags (1)
0 Karma

woodcock
Esteemed Legend
0 Karma

burwell
SplunkTrust
SplunkTrust

Have a look at this answer I just made about alert_actions.conf. This might help:

https://answers.splunk.com/answering/712944/view.html

0 Karma

manekar
New Member

I created a alert using in search head and scheduled by using cron job
under email settings gave hostaname and port number still am not receiving any emails am not seeing any logs in the python.log.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Sending email alerts via smtp is a feature splunk provides out of the box, there is no need to build it yourself.
See https://docs.splunk.com/Documentation/Splunk/7.2.3/Alert/Emailnotification for how to configure smtp servers into your splunk.

If you just want to learn how splunk does that, see sendemail.py in etc/apps/search/bin and the corresponding alert_actions.conf entry.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...