Bulk enabling alerts

joe06031990 — Fri, 17 May 2024 12:26:32 GMT

Hi,

Is there a way of bulk enabling alerts in Splunk enterprise?

Thanks,

Joe

Re: Bulk enabling alerts

PickleRick — Fri, 17 May 2024 13:01:13 GMT

You could try to do it using REST API but I'd say it's not a best idea. If you enable too many searches, you're gonna kill your servers. So it's best to enable those you need, not just all there are.

Re: Bulk enabling alerts

gcusello — Fri, 17 May 2024 13:25:00 GMT

Hi @joe06031990 ,

it's a request from many of us,

go in Splunk ideas and vote for it: maybe someone in the Splunk project will consider the request!

Ciao.

Giuseppe

Re: Bulk enabling alerts

deepakc — Fri, 17 May 2024 14:23:01 GMT

A while ago, I had to enable a number of alerts (saved searches) for an app

I created a simple bash file (Assuming your Linux based) which used the API, and this ran through them. Take note of what @PickleRick said you could end up with a performance issue if you enable too many.

This worked for me.

You need to create a Splunk token, and get a list your target alerts (saved searches) in your App , then add them to the bash script, a bit of home work, yes, but it got the job done in the end for me.

Here is an example bash script

#!/bin/bash # Define your variables TOKEN="MY SPLUNK TOKEN" SERVER="https://MY_SPLUNK_SERVER_SH:8089" APP="MY_APP" # Define alerts ALERTS=("my_alert1" "my_alert2") # Loop through each alert and enable it for ALERT in "${ALERTS[@]}"; do echo "Enabling alert: $ALERT" curl -X POST -k -H "Authorization: Bearer $TOKEN" "$SERVER/servicesNS/nobody/$APP/saved/searches/$ALERT" -d disabled=0 if [ $? -eq 0 ]; then echo "Alert $ALERT enabled successfully." sleep 10 else echo "Failed to enable alert $ALERT." fi done

You can use the below to find your alert searches names

| rest splunk_server=local /services/saved/searches | fields splunk_server, author, title, disabled, eai:acl.app, eai:acl.owner, eai:acl.sharing, id, search | rename title AS saved_search_name eai:acl.app AS app eai:acl.owner AS owner eai:acl.sharing AS sharing search AS spl_code | eval is_enabled = case(disabled >=1, "disabled",1=1, "enabled") ```| search app=YOUR APP NAME ``` | table splunk_server, author, saved_search_name, disabled, is_enabled, app, owner, sharing, spl_code

topic Re: Bulk enabling alerts in Knowledge Management

Bulk enabling alerts

Re: Bulk enabling alerts

Re: Bulk enabling alerts

Re: Bulk enabling alerts