- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a search that is run as a cron and creates an email. It is very simple;
index=my_index
host=*
logon
EventCode=4625
user != "ANONYMOUS LOGON"
Source_Network_Address != "-"
| stats count by host
| sort count desc
| head 5
| table host, count
When I run it manually I get a nice report;
host_01 23
host_02 19
host_03 18
host_04 15
host_05 10
Now, on the report I can hit the count field and a window will pop up asking me if I want to "View Events". I select it and I get all the events relating to the one host. What I'd like to do is add that link to the alert email so the recipient can read the email report and if necessary, hit the link and be taken to the report with all the specific events.
Is this possible in Splunk?
~Ed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can change the URL that is used to link to alerts, reports, etc (in the emails you receive) by going to settings -> server settings -> email settings
Change the link, footers, etc all there,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can change the URL that is used to link to alerts, reports, etc (in the emails you receive) by going to settings -> server settings -> email settings
Change the link, footers, etc all there,
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
jkat54,
Thanks. I am now working with our admin to address this issue.
~Ed
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, I found a solution, but found another problem. If you go to "Searches, Reports and Alerts" and select your "Search Name", on the next pop-up go to Alert Actions. Select "Click to edit actions" and find the "When Triggered" section. Then expand "Send Email". Here in the "Include" section, select "Link to Results". When this is done the email will contain the line "View results in Splunk". The string is actually a URL link.
Now this is all well and good except the URL contains the name of a specific search head. Our environment has clustered search heads and we can't connect to an individual one. So my question now is, can I change the URL link info from "https://:/app// @go?sid=scheduler...." to something like "https:///app// @go?sid=scheduler...."? And if I can, where and how?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The information above is a little hosed. The original URL link is:
"https://<Specific Search Head Host Name>:<Port number>/app/<app name>/ @go?sid=scheduler...."
I would like to change it to:
"https://<Generic Search Head Name>/app/<app name>/ @go?sid=scheduler...."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This post looks like it addresses this issue.