How to add URL Link to Alert Email?

[OldManEd]

I have a search that is run as a cron and creates an email. It is very simple;

index=my_index
 host=* 
 logon 
 EventCode=4625 
 user != "ANONYMOUS LOGON" 
 Source_Network_Address != "-" 

| stats count by host


| sort count desc 
| head 5
| table host, count 

When I run it manually I get a nice report;

host_01       23
host_02       19
host_03       18
host_04       15
host_05       10

Now, on the report I can hit the count field and a window will pop up asking me if I want to "View Events". I select it and I get all the events relating to the one host. What I'd like to do is add that link to the alert email so the recipient can read the email report and if necessary, hit the link and be taken to the report with all the specific events.

Is this possible in Splunk?

~Ed

[jkat54 · Accepted solution]

You can change the URL that is used to link to alerts, reports, etc (in the emails you receive) by going to settings -> server settings -> email settings

Change the link, footers, etc all there,

[OldManEd]

jkat54,
Thanks. I am now working with our admin to address this issue.
~Ed

[OldManEd]

OK, I found a solution, but found another problem. If you go to "Searches, Reports and Alerts" and select your "Search Name", on the next pop-up go to Alert Actions. Select "Click to edit actions" and find the "When Triggered" section. Then expand "Send Email". Here in the "Include" section, select "Link to Results". When this is done the email will contain the line "View results in Splunk". The string is actually a URL link.

Now this is all well and good except the URL contains the name of a specific search head. Our environment has clustered search heads and we can't connect to an individual one. So my question now is, can I change the URL link info from "https://:/app// @go?sid=scheduler...." to something like "https:///app// @go?sid=scheduler...."? And if I can, where and how?

[OldManEd]

The information above is a little hosed. The original URL link is:

"https://<Specific Search Head Host Name>:<Port number>/app/<app name>/ @go?sid=scheduler...."

I would like to change it to:

    "https://<Generic Search Head Name>/app/<app name>/ @go?sid=scheduler...."

[SabrinaP]

This post looks like it addresses this issue.