Getting Data In

Sending Email Alerts from Windows Splunk

npatellis
Explorer

I am trying to get alerting to send emails from our Windows 2008 (4.1.6 splunk) server. The email server is an open relay, yet splunk does not send the email. I believe the problem is with Windows not having an email client or forwarder.

Can someone provide some guidance on this? If I need a client, what is the recommendation?

Thanks

Tags (2)
0 Karma

au_chrismor
Explorer

Yes. It needs to be an SMTP service (we're using Lotus Domino) and it needs to be in the "mail host" field. I would recommend that you configure the SMTP box to require authentication or have some restrictive sending rules in place to prevent it from being abused.

If you need it, I can post shots of my Splunk settings for you

0 Karma

jeffrolc
New Member

I'm having this same problem. Should the mail server that is set to relay be in the "mail host" box?

0 Karma

Ant1D
Motivator

Hi,

You will need an email client (I.e. A server that sends out emails)

In Manager » System settings » Email alert settings, you will need to specify the host address of this email client to send out email alerts on behalf of your Splunk instance.

0 Karma

jeffrolc
New Member

When you say "email client" what exactly are you referring to, a client like outlook or a mail server as an open relay?

0 Karma

Ant1D
Motivator

My understanding is that Splunk expects an email client to do the email sending. The emails will contain the results data from a scheduled search that triggered the alert.

0 Karma

npatellis
Explorer

That is configured. Maybe the question is more of does Splunk form and sent the emails to the email server or does it expect an underlying email client to do the sending?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...