Alerting

Is there a way to modify alert url $results.url$ in email alerts?

the_wolverine
Champion

In our email alerts, the $results.url$ link generated by Splunk uses the local SH (which triggered the alert). Is there some way to modify the resulting url so that users get the VIP instead of the local SH?

For example, the URL is https://splunksearchhead1.corp.com:8000/blahblah/sid=12345. I would like the result link to be https://splunk.corp.com/blahblah/sid=12345.

1 Solution

the_wolverine
Champion

Yes. Within each searchhead, you must set the value of hostname in local/alert_actions.conf under the email stanza:

[email]
hostname = https://splunk.corp.com

View solution in original post

cybermonday
Explorer

A very simple solution is -

go to any of the SH's settings> server settings> email setting>
define here : "Link Hostname" . put your load balancer's URL here with protocol and port.
like - https://mysplunkLBvip.mydomain.com:8000
This will solve the issue.

Under the hood, this will add the below in system local of each of the clustered SH in alert_actions.conf

[email]
hostname=https://mysplunkLBvip.mydomain.com:8000
0 Karma

the_wolverine
Champion

Yes. Within each searchhead, you must set the value of hostname in local/alert_actions.conf under the email stanza:

[email]
hostname = https://splunk.corp.com

thambisetty
SplunkTrust
SplunkTrust

@the_wolverine 
This answer is old. but its still valid as of today. 

————————————
If this helps, give a like below.
0 Karma

maityayan1996
Path Finder

It's not working in my system. I have tried a lots of time over here.

0 Karma

maityayan1996
Path Finder

Hi sorry to disturb you again. I solved it.
You have to put https://splunk.corp.com:443 port if your servers are connected with the load balancer group.

0 Karma

DimasSouza
Path Finder

Thank you! That solved my problem as well.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...