Where can I find which email server Splunk uses? An advanced user is asking ; - )
If you have access to your internal index. You can try the following:
index=_internal source="*/python.log" "Sending email"
You should see a field called server.
server="localhost"
Hi dddillic,
If you want to see the config for the mail server you can use either of these commands:
| rest /services/configs/conf-alert_actions/email
| table mailserver
or
$SPLUNK_HOME/splunk btool alert_actions list email
and look for the mailserver
option.
Hope this helps ...
cheers, MuS
Perfect. It's all localhost -
If you have access to your internal index. You can try the following:
index=_internal source="*/python.log" "Sending email"
You should see a field called server.
server="localhost"
what is behind localhost ? is it the relayhost which is setup under postfix configuration ?
Thank you!