topic Re: Why do the alerts not have a delete or schedule option in the search head? in Alerting

Why do the alerts not have a delete or schedule option in the search head?

bpadmanbhachari — Tue, 14 Aug 2018 07:12:29 GMT

The customer has 3 search heads in a cluster environment, they have pushed savedsearches.conf from the deployer. Now they are unable to delete or schedule those alerts via Splunk web, it is grayed out

Re: Why do the alerts not have a delete or schedule option in the search head?

bpadmanbhachari — Tue, 14 Aug 2018 11:20:01 GMT

I'm answering my own question:

When you push the savedsearches from the deployer, it will become Baseline knowledge objects for search head where you cannot move, share or schedule via splunk web. This is default splunk behaviour. For information on baseline objects please refer below document.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Management_of_app-level_knowledge_objects

Re: Why do the alerts not have a delete or schedule option in the search head?

altink — Wed, 20 Jan 2021 14:44:48 GMT

How does one delete the Alert when there is no Delete option in the Alert's Edit Menu?

best

Altin