I feel rare that I should make change in "Link hostname". I would think that's the external facing address, which shows correct link in email, and now that's pointing to the SSO Apache.
If PDF server is making use of it, then it seems wrong.
Now I can make the PDF generation correct by leaving "Link Hostname" blank. It can have PDF attached in email but the direct link in email is wrong now, since it's not pointing to apache but the Splunk port indeed.
I would suggest another hostname:port for links email alert.
... View more