Splunk URL is not correct for my Splunk Alerts

[RAVISHANKAR]

Splunk URL contains only the hostname in all my Splunk alerts and it's not reproducing the correct URL instead it's just giving only the hostname.

For Ex - In my Splunk alerts it contains the URL like below;

http://hostname:8000/app/search/

But it should be 

http://hostname.domain.com/app/search

What could be the cause?

Thanks

[arughra]

Not sure why its not mentioned anywhere but if you're trying to modify the splunk url for an integration(eg. alert to pagerduty)  , I found that I had to modify the command field in pagerduty_incidents app to remove `results_link=%results.url%`

should be :

/etc/apps/pagerduty_incidents/local/alert_actions.conf

[pagerduty]
command = sendalert $action_name$ results_file="$results.file$"
hostname = http://hostname.domain.com

[livehybrid · Accepted solution]

Hi @RAVISHANKAR 

You need to set the value of 'hostname' in local/alert_actions.conf under the email stanza:

[email]
hostname = http://hostname.domain.com

Check out https://community.splunk.com/t5/Alerting/Is-there-a-way-to-modify-alert-url-results-url-in-email-ale... for more info

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[RAVISHANKAR]

Thanks @livehybrid  - It works 🙂