Edit an alert

iherb_0718 — Mon, 28 Dec 2020 05:30:12 GMT

Splunkers,

I created a simple alert and now I want to go back and edit the search. Within the ALERTS, I find the alert and then click "EDIT ALERT". I don't see anywhere that shows me the original search. I don't want to have to delete the alert and recreate a new one with the proper search.

I have also tried DISABLING the alert to see if I then get the option to Edit the search but it does not.

Is this normal or am I missing something?

I am using Splunk Cloud.

Re: Edit an alert

scelikok — Mon, 28 Dec 2020 05:56:21 GMT

Hi @iherb_0718,

You have two options to edit an alert;

1- Clicking "Open in Search" to edit the search of an alert. On new window you should see Save and Save As options.

2- Go to Settings | "Searches, reports, and alerts" | Type--> Alerts | Edit Alert

If this reply helps you an upvote is appreciated.

topic Edit an alert in Splunk Enterprise

Edit an alert

Re: Edit an alert