topic Re: Add/Update email in alert in Alerting

Add/Update email in alert

AlokPanday — Thu, 02 Dec 2021 11:51:24 GMT

I have created a search which is working fine. It sends an email when the alert condition meets.

My question is, is there any way I can add/update the email address in my alert using curl command?

also can I update my alert search query using curl command?

Thanks,

Regards,

Re: Add/Update email in alert

Gr0und_Z3r0 — Thu, 02 Dec 2021 12:32:53 GMT

You can create a search and send email to any email address you want using the sendemail function.
This can be only done by using the Splunk's REST API.
You can create custom REST endpoints if needed in Splunk to cater certain functions.

Also explore the Splunk's Java and Python SDK.

Sharing some resources to explore and refer

https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/
https://docs.splunk.com/Documentation/Splunk/8.2.3/RESTREF/RESTlist
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail
https://docs.splunk.com/Documentation/Splunk/8.2.3/RESTTUT/RESTsearches
https://dev.splunk.com/enterprise/docs/devtools/java/sdk-java/

Re: Add/Update email in alert

isoutamo — Thu, 02 Dec 2021 14:34:29 GMT

that's work like @Gr0und_Z3r0 said. For curiosity, what it the problem which you are trying to solve? Just wondering is there any other way to solve it.

r. Ismo

Re: Add/Update email in alert

AlokPanday — Fri, 03 Dec 2021 11:13:10 GMT

Thanks, @Gr0und_Z3r0 for the replay.

@isoutamo I have created an alert in Splunk and I want to create a user interface from where I can update the alert like

curl --location --request POST 'https://localhost:8089/servicesNS/nobody/MP/saved/searches/test4' \

--data-urlencode 'description=Test4 alert' \

--data-urlencode 'alert.severity=4' \

--data-urlencode 'dispatch.earliest_time=-20m' \

--data-urlencode 'dispatch.latest_time=now' \

--data-urlencode 'cron_schedule=*/5 * * * *'

user will be able to update the fields from Interface.

Thank you..