Removing the Port Number from the "Link Hostname" in Splunk Emails

[Keigo]

Hello everyone,

I'm seeking guidance regarding the links included in alert and report action emails sent from Splunk.

Please excuse me if the following English is awkward, as I used a translation tool.

Is it possible to remove the port number from the "View Result" hyperlink in the email body?

Specifically, I want to change the link format from: hostname.com:8000/app/search...

to: hostname.com/app/search...

Context: Our web access environment uses a proxy setup: Client -(HTTPS)-> Proxy -(TCP:8000)-> Splunk Web

Because of this configuration, the actual access to Splunk Web is effectively set to use port 8000, which is why the port number is currently included in the generated link.

Any advice or recommended configuration changes would be highly appreciated!

Thank you!

[PrewinThomas]

@Keigo 

Yes you can change this. [email] stanza in alert_actions.conf (or in the UI under Settings → Server settings → Email settings) is what Splunk uses when it builds the “View Results” link in alert emails. The hostname key there overrides whatever Splunk would normally derive from the local web listener

Edit alert_actions.conf and set the hostname

[email]
hostname = https://hostname.com

or with Splunk UI,

Go to Settings > Server settings > Email settings > Find the Link hostname field and set it

Regards,
Prewin
🌟If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

[Keigo]

We have already implemented the suggested configuration, but the resulting hyperlinks still include the port number, which is why we are reaching out with this question.

Specifically, we edited the Link hostname via the Web UI at Settings > Server settings > Email settings. We also confirmed that the same setting configured in the Web UI was correctly reflected in the alert_actions.conf file.

[PrewinThomas]

@Keigo 
Can you also try in the global settings.

Refer this
#https://community.splunk.com/t5/Installation/Remove-port-from-Splunk-alert-URLS-WITHOUT-changing-act...