Hi Splunk, My company recently purchased the enterprise edition after using free for year or two, and so I've been digging into the various features unlocked to us. Currently I've been working with alerting and trying to configure Splunk to send e-mails, however I've run into some issues. To start, I'm using the command below to test the e-mail configuration: index=main | head 5 | sendemail [email protected] server="email-smtp.us-west-2.amazonaws.com:587" subject="Here is an email notification" message="This is an example message" sendresults=true inline=true format=raw sendpdf=true I was originally trying to use alerts to test, however the error reporting with that method is abysmal, as it only ever gave me a 'ERROR:root:[Errno 111] Connection refused while sending mail' in the splunkd.log. By using the command mentioned above, I was finally able to get a better error message: 'command="sendemail", (530, 'Must issue a STARTTLS command first') while sending mail to:' This is the ${SPLUNKHOME}/etc/system/local/alert_actions.conf [email] auth_password = PASSHERE auth_username = USERHERE from = [email protected] mailserver = email-smtp.us-west-2.amazonaws.com:587 use_tls = 1 use_ssl = 0 hostname = 127.0.0.1 I've tried switching it over to SSL and using port 443 but it generates the same error. Is this something I can specify in the search string, or will I need to mess around with the python script? Also, the e-mail settings page in the Splunk web GUI will clear out the SMTP password every time you save, unless one is entered. This means every time I make a change to the config using the GUI, I need to enter the password. I don't know if this is the intended functionality, just thought I'd give you guys a heads up. EDIT: Thank you for the code block, and I forgot to mention we're on the latest version of Splunk, 6.2.1. ... View more