modify the saved splunk Alert using api

venugoski — Tue, 17 Oct 2023 00:35:23 GMT

looking for help in editing the saved Alert query using the api/curl .
i would like to change the pod_count 9 to 12 . how can i do that using api/curl

alertname = test_goski-list
alert query =

index=list-service source="eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;" "kubernetes.namespace_name"="list-service" | stats dc(kubernetes.pod_name) as pod_count | where pod_count < 9

i am trying to run the below curl to connect to the search head IP and getting the error response.

curl -k -u admin:changeme -X POST https://10.236.140.2:8089/servicesNS/admin/search/alerts/test_goski-list -d "search=index=list-service"

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Not Found</msg>
</messages>
</response>

Re: modify the saved splunk Alert using api

isoutamo — Tue, 17 Oct 2023 06:15:21 GMT

maybe this helps youhttps://community.splunk.com/t5/Alerting/Why-can-t-I-change-alert-with-REST-It-change-permission-from-app/m-p/646456/thread-id/15104/highlight/false#M15117

It’s old answer where I change some parameters on query. I think that you could change the query just like those parameters on conf.

r. Ismo

topic modify the saved splunk Alert using api in Security

modify the saved splunk Alert using api

Re: modify the saved splunk Alert using api