It is an Outlook question if you can enable it to send email using your credentials from Splunk or any other external service. As far as I remember, you can't just use user/password to authenticate to Outlook's SMTP and Splunk doesn't support (at least not using built-in sendemail.py) alternative modes of authentication.   ... View more

Your data that's already in ingested needs to be made CIM complaint, it might be worth spending some time getting your head around the CIM concepts, after this you can look  at developing correlation rules.    https://lantern.splunk.com/Splunk_Platform/Product_Tips/Data_Management/Complying_with_the_Splunk_Common_Information_model  ... View more

You need to follow these steps (its basic SMTP connection) for alerts for Splunk cloud or on premise.  https://docs.splunk.com/Documentation/Splunk/9.2.1/Alert/Emailnotification  There's not that many settings for this in Splunk - so it should work providing your SMTP / Email server allows for this.  We point to an SMTP server as per the config above.  If its not working and you feel your have setup according to the Splunk docs, I would look at your "Exchange Admin Centre" and consult the Admin to ensure Splunk can send to to the SMTP server.  The  ... View more