I have created Alerts in Splunk to send emails when anomalies are seen in our infrastructure. This is pretty handy and to make investigation easier, I customized the Alert message to include a link to a dashboard with graphs showing what was observed with all the needed parameters (e.g. the Time Period at which it happened) to open the dashboard in the right context. For example, I get Alert emails with this content:
Check the Health dashboard for details:
https://msr-us-splunksearch01.ubisoft.onbe:8000/en-US/app/UbiServices/health_new?earliest=2015-01-26...
_time AvgProcessingTime High LatencyPeak Low Prediction
Mon Jan 26 04:31:20 2015 0.190746 0.126853161957 0.0912334475113 0.0912334475113 0.109043304734
Mon Jan 26 04:31:30 2015 0.375882 0.202649048873 0.104941468384 0.104941468384 0.153795258628
This is great and works fine when I read the email from my office desktop. However, when I read the email from my phone outside office hours, I would really like to be able to click on a link to jump direclty on the dashboard on the Splunk Mobile App. Linking to Mobile apps is quite simple on iOS and work fine by simply having a URL that start with the app name (splunk://). You guys took advantage of that for device registration where I can send a email back to the requestor with a link that looks like this: splunk://config/qY/...
Now it would be awesome if I can embed something like this in my Alert emails:
splunk://app/UbiServices/health_new?earliest=2015-01-26T04:29:00.000+00:00&latest=2015-01-26T04:44:00.000+00:00&form.EnvironmentFilter=PROD&form.EntryPointFilter=*
Maybe it's already enabled but after a couple of tries, I could not properly guess what the URL should look like.
