Close. You don't need to restart the DS. Just reload the deployment classes. (if you're doing it via CLI, if I remember correctly, the GUI takes care of that automatically) ... View more

@sainag_splunk Thankyou, I had to struggle a lot before getting to this, You can simply change sender's email address in below configuration and it worked for me.  /splunk/etc/system/local/alert_actions.conf [email] mailserver = localhost pdf.header_left = none pdf.header_right = none from = Splunk@companyname.com Before making config changes, you can test it out first to see its a valid email/company domain combination, <your Search>| sendemail to= <your email>  from= Splunk@companyname.com ... View more

Hi, SkyFormation does exactly that, you can see us at Splunk base - https://splunkbase.splunk.com/app/2932/ SkyFormation retrieves the data from Office 365, enrich and normalize it, then communicates it to Splunk in Syslog\CEF format. Feel free to contact me directly - nimrod (at) skyformation.com Nimrod ... View more