topic Re: How can we move alerts from one app to another? in Alerting

How can we move alerts from one app to another?

splunker9999 — Wed, 02 Mar 2016 16:06:41 GMT

Hi,

We need to move few alerts from one app to another, is there a way we can do this?

Thanks

Re: How can we move alerts from one app to another?

harsmarvania57 — Wed, 02 Mar 2016 16:11:41 GMT

Hi,

You can see "Move" button for that alert in Setting -> Searches, reports, and alerts and select new application.

Thanks,
Harshil

Re: How can we move alerts from one app to another?

woodcock — Wed, 02 Mar 2016 19:58:43 GMT

Assuming that you do not have CLI access to your Search Head and that you do not have a Deployment Server, then, if you have several in one app and need to move them to another app you can export both apps using the app exporter tool, hand merge them and then upgrade the app with the merged app zip/tgz file:

https://splunkbase.splunk.com/app/2613/

Re: How can we move alerts from one app to another?

chimell — Thu, 03 Mar 2016 10:55:33 GMT

Hi
In Splunk web , go to Setting- -> Searches, reports, and alerts in Actions column click on clone of your existing alert, in open form choose your new app in Destination app ** dropdown and **save

Re: How can we move alerts from one app to another?

gyslainlatsa — Thu, 03 Mar 2016 11:49:24 GMT

hi splunker9999,

all alerts are setup in your savedsearches.conf (there could by multiple files!) you must check for any action.* items, because this will define an alert. Copy all the stanza alerts that you want to move into a new savedsearches.conf file, then copy and paste the file into your target application (in the default directory or local).

then you restarted splunk and everything will work.

for more informations about savedsearches or savedsearches.conf, see this link:

http://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Configuringalertsinsavedsearches.conf

Re: How can we move alerts from one app to another?

ltrand — Tue, 07 Mar 2017 13:56:57 GMT

To programatically complete the move, do the following:

curl -k -u admin:pass https://localhost:8089/servicesNS/nobody/myapp/saved/searches/mysearch/move  \
        -d user=nobody \
        -d app=otherapp

https://docs.splunk.com/Documentation/Splunk/6.5.2/RESTTUT/RESTbasicexamples#Move_an_object_to_a_different_app

Re: How can we move alerts from one app to another?

woodcock — Tue, 07 Mar 2017 20:52:22 GMT

What a GREAT selection of answers! Make sure that you pick the one that worked best for you and up-vote any that worked at all.

Re: How can we move alerts from one app to another?

harsmarvania57 — Fri, 04 Oct 2019 08:33:25 GMT

Just to update, if anyone want to move mutiple knowledge objects from one app to another then it'll be pain in Splunk WebGUI because you need to move knowledge object one by one, to simplified this I have created python script which uses Splunk REST API to move multiple knowledge objects https://github.com/harsmarvania57/splunk-ko-change (NOTE: Please use that script at your own risk :P)