Hello @gcusello ,  I found that the email is failing because the user left the organization. The other 4 people are receiving the email fine. I reviewed the savedsearches.conf for the specific alert and do not see the user's email id. Even on the console it just shows the 4 current users. But the failure email shows 5 emails 4 current users and 1 user who left the organization. This is definitely a stale entry. Restarting Splunk did not fix the issue. Any other way to look into this? ... View more

Hi @gcusello , The email and SMTP are OK, As the other users are receiving emails and other alerts are fine The failed email notification shows 5 emails and when I checked the alert schedule there are only 4 emails let's say [email protected] is missing in the schedule. Is there a way to check if this is a stale entry in a config file? Will there be any config file that stores the email recipients? will a Splunk restart force Splunk to pick the recipients present in the alert schedule? ... View more