In our email alerts, the $results.url$ link generated by Splunk uses the local SH (which triggered the alert). Is there some way to modify the resulting url so that users get the VIP instead of the local SH?
For example, the URL is https://splunksearchhead1.corp.com:8000/blahblah/sid=12345. I would like the result link to be https://splunk.corp.com/blahblah/sid=12345.
Yes. Within each searchhead, you must set the value of hostname in local/alert_actions.conf under the email stanza:
[email]
hostname = https://splunk.corp.com
A very simple solution is -
go to any of the SH's settings> server settings> email setting>
define here : "Link Hostname" . put your load balancer's URL here with protocol and port.
like - https://mysplunkLBvip.mydomain.com:8000
This will solve the issue.
Under the hood, this will add the below in system local of each of the clustered SH in alert_actions.conf
[email]
hostname=https://mysplunkLBvip.mydomain.com:8000
Yes. Within each searchhead, you must set the value of hostname in local/alert_actions.conf under the email stanza:
[email]
hostname = https://splunk.corp.com
@the_wolverine
This answer is old. but its still valid as of today.
It's not working in my system. I have tried a lots of time over here.
Hi sorry to disturb you again. I solved it.
You have to put https://splunk.corp.com:443 port if your servers are connected with the load balancer group.
Thank you! That solved my problem as well.
You can set the link hostname here: http://splunk.corp.com/en-US/manager/launcher/admin/alert_actions/email?action=edit