Alert Email notification is not being sent

Applicability

Splunk Enterprise

Description

When trying to set up email alerts, the emails are not being sent

Investigation

The alert email notification was not being sent after setting a new mail host in order to send the test email and then the old SMTP server was set in Splunk using the UI.

The query for testing purposes was:

index=_internal 
| head 5 
| sendemail to="****@***.com" subject=IGNORESplunkAlertTEST sendresults=true server="The new mail host"

The email notification was successfully received when this query was run. But the old usual alert notifications stopped even after setting back the old mail host using the UI.
 

Resolution

alert_actions.conf file was checked and the credentials from the newest mail host were found instead of the old SMTP server.

auth_username   = <string>
* The username to use when authenticating with the SMTP server. If this is
  not defined or is set to an empty string, no authentication is attempted.
  NOTE: your SMTP server might reject unauthenticated emails.
* Default: an empty stringauth_password   = <password>
* The password to use when authenticating with the SMTP server.
  Normally this value is set when editing the email settings, however
  you can set a clear text password here and it is encrypted on the
  next Splunk software restart.
* Default: an empty string

After changing these attributes and restart Splunk, the old alerts were tested and the email notifications were received again.
 

Related Links

alert_actions.conf:
email

Splunk Answers:
Why is my triggered alert email not sending?

Splunk Community:
How to troubleshoot Splunk email notification
How do I troubleshoot why Splunk is not sending alert emails?
 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release