Splunk Search

How to add URL Link to Alert Email?

OldManEd
Builder

I have a search that is run as a cron and creates an email. It is very simple;

index=my_index
 host=* 
 logon 
 EventCode=4625 
 user != "ANONYMOUS LOGON" 
 Source_Network_Address != "-" 

| stats count by host


| sort count desc 
| head 5
| table host, count 

When I run it manually I get a nice report;

host_01       23
host_02       19
host_03       18
host_04       15
host_05       10

Now, on the report I can hit the count field and a window will pop up asking me if I want to "View Events". I select it and I get all the events relating to the one host. What I'd like to do is add that link to the alert email so the recipient can read the email report and if necessary, hit the link and be taken to the report with all the specific events.

Is this possible in Splunk?

~Ed

Labels (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

You can change the URL that is used to link to alerts, reports, etc (in the emails you receive) by going to settings -> server settings -> email settings

Change the link, footers, etc all there,

View solution in original post

jkat54
SplunkTrust
SplunkTrust

You can change the URL that is used to link to alerts, reports, etc (in the emails you receive) by going to settings -> server settings -> email settings

Change the link, footers, etc all there,

OldManEd
Builder

jkat54,
Thanks. I am now working with our admin to address this issue.
~Ed

0 Karma

OldManEd
Builder

OK, I found a solution, but found another problem. If you go to "Searches, Reports and Alerts" and select your "Search Name", on the next pop-up go to Alert Actions. Select "Click to edit actions" and find the "When Triggered" section. Then expand "Send Email". Here in the "Include" section, select "Link to Results". When this is done the email will contain the line "View results in Splunk". The string is actually a URL link.

Now this is all well and good except the URL contains the name of a specific search head. Our environment has clustered search heads and we can't connect to an individual one. So my question now is, can I change the URL link info from "https://:/app// @go?sid=scheduler...." to something like "https:///app// @go?sid=scheduler...."? And if I can, where and how?

0 Karma

OldManEd
Builder

The information above is a little hosed. The original URL link is:

"https://<Specific Search Head Host Name>:<Port number>/app/<app name>/ @go?sid=scheduler...."

I would like to change it to:

    "https://<Generic Search Head Name>/app/<app name>/ @go?sid=scheduler...."
0 Karma

SabrinaP
Splunk Employee
Splunk Employee

This post looks like it addresses this issue.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...