Dashboard Studio scheduled export emails use splunk@ instead of the configured From address

Applicability

Description

Customer reports that a user is configuring a weekly "Export JSON" email for a metrics dashboard in Splunk Enterprise 10.4.3.

The generated email does not use the expected From address configured under Settings > Server Settings > Email Settings > Send email as. As a comparison, exporting/sending a PDF from a Classic dashboard uses the configured From address correctly.

Frequency: Reproducible when testing the weekly "Export JSON" email workflow. Start date: Unknown / not provided by customer.

Investigation

Dashboard Studio scheduled export emails do not use the sender configured under:
Settings > Server Settings > Email Settings > Send email as
The configured sender may be a fully qualified email address such as:
splunk-alerts@example.com

However, emails generated by Dashboard Studio scheduled exports may instead use:
splunk@<search_head_hostname>

The behavior may be observed with:
- Send test email from the Dashboard Studio Schedule Export dialog.
- Actual scheduled Dashboard Studio exports.
Classic dashboard email exports may continue to use the configured From address correctly.
The Dashboard Studio schedule may also not be visible under:
Settings > Searches, Reports, and Alerts
Symptoms
The effective email configuration shows the expected sender:
$SPLUNK_HOME/bin/splunk btool alert_actions list email --debug

Example:
from = splunk-alerts@example.com
mailserver = smtp.example.com
hostname = example.com

Despite this, the received Dashboard Studio export email shows a sender or Return-Path similar to:
splunk@searchhead01.example.com

A Classic dashboard export from the same Splunk environment may correctly use:
splunk-alerts@example.com

Resolution

For Splunk Enterprise 10.4.3, configure the desired email sender in savedsearches.conf.
Option 1: Global saved-search default
If it is acceptable for saved-search email actions to use the same sender globally, configure:
[default]
action.email.from = splunk-alerts@example.com

For a Search Head Cluster, deploy this through an app using the SHC deployer.
Example deployer path:
$SPLUNK_HOME/etc/shcluster/apps/<app_name>/local/savedsearches.conf

Example configuration:
[default]
action.email.from = splunk-alerts@example.com

After deployment, verify the effective configuration:
$SPLUNK_HOME/bin/splunk btool savedsearches list --debug

For Splunk Enterprise 10.4.3, configure the desired email sender in savedsearches.conf.
Option 1: Global saved-search default
If it is acceptable for saved-search email actions to use the same sender globally, configure:
[default]
action.email.from = splunk-alerts@example.com

For a Search Head Cluster, deploy this through an app using the SHC deployer.
Example deployer path:
$SPLUNK_HOME/etc/shcluster/apps/<app_name>/local/savedsearches.conf

Example configuration:
[default]
action.email.from = splunk-alerts@example.com

After deployment, verify the effective configuration:
$SPLUNK_HOME/bin/splunk btool savedsearches list --debug