Splunk scheduled report 'Email when done' option sends me a link with a private IP that I cannot open.

[moizmmz]

Hello,

I created a scheduled report in Splunk to send me an email with a link to the report and its results. However, in the email, the link returned is through a private IP address. Which is why it doesn't open. I understand that this is because the IP address belongs to one of my search heads which sits in a private network. But is there a way I can get the results on a public IP and send that link to my email instead, so I can view it?

I'm a little stumped here. Thanks.

[burwell]

Hello. We have our Splunk heads in a cluster behind a load balancer.

I create /opt/splunk/etc/system/local/alert_actions.conf with the following. This way the link that is sent out is to our cluster, not an individual head. Also it is handy to have the link for people to click on to see.

[email]
from = splunk@mydomain.com
mailserver = mymailserver:25
hostname = http://myloadbalancer:myport

[manekar]

no luck. I am not seeing any errors under python.log.

Thanks,

[petom]

Have you restarted Splunk after applying the configuration?
It should work as @burwell wrote it.

[manekar]

Yes i restarted it.

Thanks,
Swathi

[manekar]

hostname=indexhostname.

Please let me is it correct ?

[burwell]

Sorry I just saw your question @manekar

As to what the hostname is for

https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Alertactionsconf

Sets the hostname used in the web link (url) sent in alerts.

So you would put the search head server name. Can you try that?

[richgalloway]

Why not have the results included in the email instead of a link?

[moizmmz]

Good question 😛 Well, my manager sees that there is a problem and he expects me to fix it. There are other solutions, but I guess he just prefers this one 😛

[moizmmz]

Thank you though 🙂