How do I change the URL used in email alerts

[imacdonald2]

Currently links to reports that are emailed out contain just the hostname, not the fully qualified machine name. Our build standard is command host should return just the hostname and host -f returns hostname.fqdn.com. I have set serverName in /opt/splunk/etc/system/local/server.conf to hostname.fqdn.com but the links still come out using hostname

[cnk · Accepted solution]

By links to reports do you mean alert emails? For alert emails you can set the hostname option in alert_actions.conf.

alert_actions.conf.spec

hostname = <string>
    * Sets the hostname used in the web link (url) sent in alerts.
    * This value accepts two forms.
       * hostname
        examples: splunkserver, splunkserver.example.com
       * protocol://hostname:port
        examples: http://splunkserver:8000, https://splunkserver.example.com:443
    * When this value is a simple hostname, the protocol and port which
      are configured within splunk are used to construct the base of
      the url.
    * When this value begins with 'http://', it is used verbatim.  
      NOTE: This means the correct port must be specified if it is not
      the default port for http or https.
    * This is useful in cases when the Splunk server is not aware of
      how to construct an externally referencable url, such as SSO
      environments, other proxies, or when the Splunk server hostname
      is not generally resolvable.
    * Defaults to current hostname provided by the operating system, or if that fails "localhost".
    * When set to empty, default behavior is used.

HTH