We are using Splunk Light 6.3.1. Regardless of which settings we set in Mail Server Settings, it always tries to send emails to localhost instead. The Mail host is definitely set to a valid address, similar to foo.bar.com:587 . Checking alert_actions.conf also confirms this. We are trying to send mail via a scheduled hourly report. From python.log: ERROR sendemail:115 - Sending email. subject="Splunk Report: Foo", results_link="http://splunk.domain.com:8000/app/search/@go?sid=scheduler__admin__search__Foo_at_1447151400_3", recipients="[u'[email protected]']", server="localhost" ERROR sendemail:378 - [Errno 111] Connection refused while sending mail to: [email protected] Of course the connection is refused, mail should be sent to the defined mail server, not localhost! Any ideas? Many thanks! ... View more