topic Re: Splunk Alert - No Delete option on Edit/Menu in Alerting

Splunk Alert: How do I delete when there is no Delete option on Edit/Menu?

altink — Mon, 14 Mar 2022 19:15:05 GMT

Hi

Cannot delete an Alert.
There is no Delete Option under Alert's Edit Menu.

Please advise how to delete.

best regards

Altin

Re: Splunk Alert - No Delete option on Edit/Menu

manjunathmeti — Wed, 20 Jan 2021 14:48:25 GMT

Is this alert created by you or it is part of an app?

If this alert exists in the app's default folder you need to remove it from the app and then deploy the app again. If you don't have access to do that then you can always disable the alert.

Re: Splunk Alert - No Delete option on Edit/Menu

altink — Wed, 20 Jan 2021 14:55:38 GMT

Alert is part of an application. And it is owned by Admin.
I am logged as Admin - and cannot delete it

best

Altin

Re: Splunk Alert - No Delete option on Edit/Menu

altink — Wed, 20 Jan 2021 14:58:51 GMT

How do I "remove it from the app" ?
(this ticket was opened for this)
best

Altin

Re: Splunk Alert - No Delete option on Edit/Menu

manjunathmeti — Wed, 20 Jan 2021 14:59:00 GMT

If it is part of the application's default directory then even admin can't delete it. You need to delete it from app and deploy the application again.

Re: Splunk Alert - No Delete option on Edit/Menu

altink — Wed, 20 Jan 2021 15:07:55 GMT

Do you mean I need to delete the Alert in the config file, in the OS?
And then restart Splunk?

best regards

Altin

Re: Splunk Alert - No Delete option on Edit/Menu

manjunathmeti — Wed, 20 Jan 2021 15:08:25 GMT

Alert exists in savedsearches.conf file. You can remove the alert stanza from conf file. Below is the sample path.

1. If the search head is not in cluster then remove stanza from below path and restart splunk.
$SPLUNK_HOME/etc/apps/<app_directory>/default/savedsearches.conf

2. If the search head is in cluster then remove stanza from below path on deployer server then apply the bundle.
$SPLUNK_HOME/etc/shcluster/apps/<app_directory>/default/savedsearches.conf

Re: Splunk Alert - No Delete option on Edit/Menu

altink — Wed, 20 Jan 2021 15:23:40 GMT

Thank you very much @manjunathmeti

best regards,

Altin

Re: Splunk Alert - No Delete option on Edit/Menu

TheGearx — Mon, 14 Mar 2022 15:14:03 GMT

What you must do is

-Download the app and delete the alert/search

-upload the Custom app and the scheduled alert/search must disappear