Splunk Search

Configure URL in saved search results


I have SSO working with apache responding to a "splunk" cname. But when splunk emails search results the URL is https://hostname:port/... How can I configure splunk to just use a "https://splunk" url so connections will pass through apache?

Tags (1)
0 Karma

New Member

I solved this problem in my Apache SSO setup - Splunk e-mail alerts contained http://hostname:8000/app/ rather than https://hostname/app/. I was unable to convince Splunk to change its URL, but I was successful in configuring Apache to redirect the broken URLs to the correct location.

First I configured Splunk to listen only on the loopback address in /usr/local/splunk/etc/system/local/web.conf:

server.socket_host =

Then I added a VirtualHost to Apache listening on the public IP, port 8000 to redirect to the correct URL. In RHEL/CENTOS' /etc/httpd/conf.d/vhost-splunk-redirect.conf:


    RewriteEngine On
    RewriteRule .* https://hostname.com%{REQUEST_URI} [R,L]

With this configuration Splunk alert URLs redirect to their equivalent, functional SSO/SSL URLs.

0 Karma


In alert_actions.conf:

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...