topic Re: Splunk Alerting: Identify all the alerts which are using same webhook in Alerting

Splunk Alerting: Identify all the alerts which are using same webhook

arkapdas — Tue, 03 Aug 2021 19:36:10 GMT

hi all, I have a specific webhook url which has been used in multiple splunk alerts. Now I want to change that webhook. I was trying to figure out, is there any way I can figure out what are the alerts which are using this particular webhook

Re: Splunk Alerting: Identify all the alerts which are using same webhook

venkatasri — Wed, 04 Aug 2021 01:35:44 GMT

Hi @arkapdas

The following command shall return the alerts and their actions you have to find what's the field name for webhook and further filter it to your need.

| rest /services/saved/searches | where isnotnull(title) | table action* id title search

Re: Splunk Alerting: Identify all the alerts which are using same webhook

arkapdas — Thu, 05 Aug 2021 23:07:46 GMT

You saved my life, now I am pushing it a little more [:P]

Is there any way I can update the values in one shot?

Re: Splunk Alerting: Identify all the alerts which are using same webhook

venkatasri — Fri, 06 Aug 2021 07:36:41 GMT

@arkapdas goto savedsearches.conf on SH and update them from backend.