We are using Splunk Light 6.3.1. Regardless of which settings we set in Mail Server Settings, it always tries to send emails to localhost instead.
The Mail host is definitely set to a valid address, similar to foo.bar.com:587 . Checking alert_actions.conf also confirms this.
We are trying to send mail via a scheduled hourly report.
From python.log:
ERROR sendemail:115 - Sending email. subject="Splunk Report: Foo", results_link="http://splunk.domain.com:8000/app/search/@go?sid=scheduler__admin__search__Foo_at_1447151400_3", recipients="[u'user@domain.com']", server="localhost"
ERROR sendemail:378 - [Errno 111] Connection refused while sending mail to: user@domain.com
Of course the connection is refused, mail should be sent to the defined mail server, not localhost!
Any ideas? Many thanks!
... View more