Uniform Alert Sender for Splunk SHC

jaracan — Thu, 03 Sep 2020 07:49:20 GMT

Hi Splunkers,

We recently migrated to Splunk Search Head Clustering. We are using a Load Balancer in front of 3 Search Heads Clustered so that the users can access the set of search heads through a single interface, without needing to specify a particular one.

Now, we notice that the email alerts we received are coming randomly from any of the 3 Search Heads Clustered. It means the email alert sender for Splunk SHC comes from any 3 Search Heads Clustered. Is there a way to make it appear the alert is being sent by the load balancer name? So that once the users receives the alerts, the email alert sender is uniform.

Re: Uniform Alert Sender for Splunk SHC

richgalloway — Thu, 03 Sep 2020 13:40:43 GMT

Try going to Settings->Email settings and putting the load balancer's name in the "Link hostname" field. Do it on all search heads.

topic Re: Uniform Alert Sender for Splunk SHC in Alerting

Uniform Alert Sender for Splunk SHC

Re: Uniform Alert Sender for Splunk SHC