Alerting

Backgrounded jobs don't send email alerts out when completed.

davidpaper
Contributor

For a long backgrounded job, it would be really useful to be able to get an alert sent out when it is done. Doesn't appear that my Splunk instances does this.

Emails for scheduled searches that generate alerts work just fine, so I know the email server path is fully functional.

If it makes a difference, all of our user auth is done via LDAP.

Any suggestions on ways to get this to work?

Tags (3)
1 Solution

jtrucks
Splunk Employee
Splunk Employee

This works for non-LDAP instances by simply entering the email address in the user's Splunk local account profile. This automagically works in those cases.

As for LDAP, perhaps if the correct field name is proffered to Splunk from LDAP it would correctly populate the email address field.

--
Jesse Trucks
Minister of Magic

View solution in original post

jtrucks
Splunk Employee
Splunk Employee

This works for non-LDAP instances by simply entering the email address in the user's Splunk local account profile. This automagically works in those cases.

As for LDAP, perhaps if the correct field name is proffered to Splunk from LDAP it would correctly populate the email address field.

--
Jesse Trucks
Minister of Magic

antlefebvre
Communicator

I have an open case with Splunk on this. No way to currently import email via LDAP. No ETA on fix.

0 Karma

jtrucks
Splunk Employee
Splunk Employee

I'm told that LDAP configurations often don't provide splunk with the right named field for email propogation, which is the likely cause of your issue.

--
Jesse Trucks
Minister of Magic
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...