Remove port from Splunk alert URLS WITHOUT changing actual web port

[MattH665]

Hi,

We have Splunk running behind a load balancer so we reach it on the standard port 443.

But on the backend it's using a different port, which the LB connects to, hence this port needs to stay set as the Web port.

Problem is when we get alerts, Splunk still puts that port from the Web port setting in the url. So the url doesn't work and we need to manually edit it to remove the port.

Is there no separate setting for this so that the actual listening port and the port it puts in the url can be controlled separately? 

[danielcj · Accepted solution]

Hello @MattH665 ,

I believe that you are looking for the setting:

hostname = <your_hostname> in alert_actions.conf  - https://docs.splunk.com/Documentation/Splunk/latest/Admin/Alertactionsconf#GLOBAL_SETTINGS

examples: http://splunkserver:8000, https://splunkserver.example.com:443

Remember to restart your instance after the changes.

Thanks. 

[MattH665]

Thanks @danielcj , think this is exactly what I needed. Somehow I never came across this when googling and searching around here.