I have a search that is run as a cron and creates an email. It is very simple;
index=my_index host=* logon EventCode=4625 user != "ANONYMOUS LOGON" Source_Network_Address != "-" | stats count by host | sort count desc | head 5 | table host, count
When I run it manually I get a nice report;
host_01 23 host_02 19 host_03 18 host_04 15 host_05 10
Now, on the report I can hit the count field and a window will pop up asking me if I want to "View Events". I select it and I get all the events relating to the one host. What I'd like to do is add that link to the alert email so the recipient can read the email report and if necessary, hit the link and be taken to the report with all the specific events.
Is this possible in Splunk?
OK, I found a solution, but found another problem. If you go to "Searches, Reports and Alerts" and select your "Search Name", on the next pop-up go to Alert Actions. Select "Click to edit actions" and find the "When Triggered" section. Then expand "Send Email". Here in the "Include" section, select "Link to Results". When this is done the email will contain the line "View results in Splunk". The string is actually a URL link.
Now this is all well and good except the URL contains the name of a specific search head. Our environment has clustered search heads and we can't connect to an individual one. So my question now is, can I change the URL link info from "https://:/app// @go?sid=scheduler...." to something like "https:///app// @go?sid=scheduler...."? And if I can, where and how?
The information above is a little hosed. The original URL link is:
"https://<Specific Search Head Host Name>:<Port number>/app/<app name>/ @go?sid=scheduler...."
I would like to change it to:
"https://<Generic Search Head Name>/app/<app name>/ @go?sid=scheduler...."
You can change the URL that is used to link to alerts, reports, etc (in the emails you receive) by going to settings -> server settings -> email settings
Change the link, footers, etc all there,