Alerting

Links in alerts not working

bhavneeshvohra
Engager

We have one Real Time and one scheduled alert ,in both these alerts we have alert actions as mail .
In the mail we send a link of " View results in Splunk".
But we have found that these links get expired after 24 hours .
How should we deal with this issue.?
Kindly help!!

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@bhavneeshvohra,

The expiring time of the artifacts are decided by dispatch ttl in savedsearch.conf and based on your alert actions, ttl value in alert_actions.conf will take effect.

See alert_actions.conf

ttl = <integer>[p]
* The minimum time to live, in seconds, of the search artifacts,
  if this action is triggered.
* If 'p' follows '<integer>', then '<integer>' is the number of scheduled periods.
* If no actions are triggered, the ttl for the artifacts are determined
  by the 'dispatch.ttl' setting in the savedsearches.conf file.
* Default: 10p
* Default (for email, rss)                    : 86400 (24 hours)
* Default (for script)                        :   600 (10 minutes)
* Default (for summary_index, populate_lookup):   120 (2 minutes)
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...