topic Re: A smart way to disable email alert for all saved searches in Alerting

A smart way to disable email alert for all saved searches

shangshin — Thu, 10 Oct 2013 14:33:39 GMT

Hi,
I have hundreds of saved searches for monitors running in the search heads frequently 24 * 7. Is there a way to disable all email alert for all saved searches when I am doing maintenance work on the indexers e.g. restarting. It's quite annoying to get false alarms due to failed searches.

Thanks in advance.

Re: A smart way to disable email alert for all saved searches

lukejadamec — Thu, 10 Oct 2013 14:38:42 GMT

Yes. Go to Manager >> System Settings >> Email alert settings and remove the Mail Host information (just remember what it was so you can put it back when you're done).

Re: A smart way to disable email alert for all saved searches

shangshin — Thu, 10 Oct 2013 15:59:22 GMT

Thank you. I just gave it a try and it's working. This can be used for planned change.
I wish there is a way that email alert won't go out to the recipients due to failed search.

Re: A smart way to disable email alert for all saved searches

lukejadamec — Thu, 10 Oct 2013 16:07:32 GMT

In the case of failed searches I believe it has to do with the trigger for the alert, but I'll have to test it.

Re: A smart way to disable email alert for all saved searches

shangshin — Thu, 10 Oct 2013 16:38:31 GMT

Make sense. So it will require change on the python script that is used to send email.

E.g. Exit the email python program is the message Level is ERROR

Re: A smart way to disable email alert for all saved searches

MuS — Thu, 23 Oct 2014 11:14:37 GMT

Take a look at this answer http://answers.splunk.com/answers/65828/inhibiting-alerts-from-saved-searches-that-had-search-errors.html

It was valid for all pre Splunk 6 sendemail.py scripts. For the Splunk 6.x scripts I have to test it first.

Re: A smart way to disable email alert for all saved searches

eric_chg — Tue, 29 May 2018 07:18:21 GMT

Question : Remove "Mail host" record and require any service restarting after saved ?

Re: A smart way to disable email alert for all saved searches

eric_chg — Tue, 29 May 2018 07:21:10 GMT

Question : Empty entry at Mail host field and require any service restarting after saved "Mail Server settings" ?