To be honest, if it's not "your" environment (I mean you're not administering it), I'd just create a ticket with your splunk admin team because you probably don't have enough permissions to troubleshoot it on your own. You could try to search for index=_internal sendemail.py Around the time that your alert was triggered but typically non-admin users don't have access to internal indexes. ... View more