Splunk Search

Configure URL in saved search results


I have SSO working with apache responding to a "splunk" cname. But when splunk emails search results the URL is https://hostname:port/... How can I configure splunk to just use a "https://splunk" url so connections will pass through apache?

Tags (1)
0 Karma

New Member

I solved this problem in my Apache SSO setup - Splunk e-mail alerts contained http://hostname:8000/app/ rather than https://hostname/app/. I was unable to convince Splunk to change its URL, but I was successful in configuring Apache to redirect the broken URLs to the correct location.

First I configured Splunk to listen only on the loopback address in /usr/local/splunk/etc/system/local/web.conf:

server.socket_host =

Then I added a VirtualHost to Apache listening on the public IP, port 8000 to redirect to the correct URL. In RHEL/CENTOS' /etc/httpd/conf.d/vhost-splunk-redirect.conf:


    RewriteEngine On
    RewriteRule .* https://hostname.com%{REQUEST_URI} [R,L]

With this configuration Splunk alert URLs redirect to their equivalent, functional SSO/SSL URLs.

0 Karma


In alert_actions.conf:

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...