Reporting
Highlighted

Receving error ssLink or sessionKey when trying to assess PDF function under Enterprise Security App.

Splunk Employee
Splunk Employee

Issue with assessing PDF function under Enterprise Security App. The error that is being recevied is sessionkey or sslink is unavailable than throw the following error message and go no further.

error "Can't attach PDF - either ssLink or sessionKey unavailable".

Tags (1)
Highlighted

Re: Receving error ssLink or sessionKey when trying to assess PDF function under Enterprise Security App.

Splunk Employee
Splunk Employee

Go under file /etc/systems/local/alert_actions.conf:

Modify the parameter under email by adding "sslink=$results.url$" :

[email]
command = $action.email.preprocess_results{default=""}$
"sslink=$results.url$"

You should start to receive your PDF's.

View solution in original post

Highlighted

Re: Receving error ssLink or sessionKey when trying to assess PDF function under Enterprise Security App.

Path Finder

Is this right? My [email] command setting already has that, along with a ton of other parameters.

0 Karma
Highlighted

Re: Receving error ssLink or sessionKey when trying to assess PDF function under Enterprise Security App.

Ultra Champion

Same - I have same issue and my alert_actions already has this.

0 Karma