alert

記錄使用 email 來收 splunk alert 時，遇到的情形

修改 mail notificition 的相關設定

• 修改 from email
  • How to change the “FROM” address when alert emails are sent?
  • 編輯檔案 /opt/splunk/etc/system/local/alert_actions.conf add from 變數
• 修改信件中的 hostname
  • Is there a way to modify alert url $results.url$ in email alerts?
  • 編輯檔案 /opt/splunk/etc/system/local/alert_actions.conf add hostname 變數

Trouble Shooting

• Why is my triggered alert email not sending?
  • 直接來去看 log , log path: ~/splunk/var/log/splunk/python.log