As of now when email alerts are sent, the from address is the hostname of server sending the alert.
Is it possible to change that to a generic one like the internal splunk support team.
eg: As of now the from in email alerts is
Can i get it changed to
[email]
from =
The @domain.com portion is applied by the email relay server
Create a file alert_actions.conf on the system/local of the SH, and have the below config, then restart.
cat /opt/splunk/etc/system/local/alert_actions.conf
[email]
from = splunksupport@company.com
Note: - This was an old question, providing a direct answer, than getting into docs and investigating.
@snethala_splunk Thankyou, I had to struggle a lot before getting to this,
You can simply change sender's email address in below configuration and it worked for me.
/splunk/etc/system/local/alert_actions.conf
[email]
mailserver = localhost
pdf.header_left = none
pdf.header_right = none
from = Splunk@companyname.com
Before making config changes, you can test it out first to see its a valid email/company domain combination,
<your Search>| sendemail to= <your email> from= Splunk@companyname.com
See the documentation for alertactions.conf here, specifically the from= attribute under the [email] stanza.