Issue when sending email from Splunk - custom alert action

Applicability

Splunk Enterprise Splunk Cloud

Description

Created a new application to override the sender address for alerts coming from that specific application.

Created a local .conf file for the overridden values in the following file:

/opt/splunk/etc/apps/<app_name>/local/alert_actions.conf

The contents are as follows:
 

[email]
from = Service Desk <servicedesk@your_domain.com>
footer.text =

Investigation

Create lab.

Using the configuration files:

• savedsearches.conf
• alert_actions.conf

1. Create an alert.
2. Change the 'from' field email on Splunk Web.
3. Change the 'from' field email using the configuration files.
 

Resolution

Splunk has to change the 'from' on the alerts notification on the Web UI 'Server settings' and the CLI alert_actions.conf.
The correct way to change the field 'from' is using the Web UI on the Search Head: Server settings > Email settings > Email Format > Send emails as
The change was made on the Search Head and worked correctly. For some reason, the field 'from' wasn't accepted directly in the custom app.
Always be sure that the alert on savedsearches.conf does not contain a different email server that can take precedence over the server email set in alert_actions.conf

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release