Hi there, I have performed a version upgrade from 6.5 to 7.1 and found that the Splunk instance becomes unable to send emails (scheduled reports and triggered alerts). The error messages are as follow: splunk_python: ERROR sendemail:460 - {u'[email protected]': (454, '4.7.1 : Relay access denied')} while sending mail to: [email protected] ERROR sendemail:137 - Sending email. Subject="Report subject", results_link="https://mysplunk:8000/app/search/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", recipients="[u'[email protected]']", server="email_server_ip_address" -- Would any have hit this issue before/ any clues on solving this issue? Many thanks! Regards, AL ... View more

Hi there, I have created an automatic lookup to separate events for different teams so that each events would be assigned a new field "team". Then I would like to use this field as the restrict search terms for below roles: 1. team_a_admin -> Restrict search terms "team=team_a" + inherit the admin role 2. team_a_user -> Restrict search terms "team=team_a" + inherit the user role And I found that the new role "team_a_user " is working as I expected. Those hosts not belonging to team A are filtered out. But the role "team_a_admin" is still showing all hosts. Tested on Splunk version 7.1 and 6.5, same result. Would anyone know the way to use the restrict search terms for admin role? Many thanks. DA ... View more