topic Re: Easily copy alerts to multiple splunk instances in Alerting

Easily copy alerts to multiple splunk instances

wfresch — Fri, 12 Jul 2019 15:27:58 GMT

I need to create the same alert for several splunk instances. Is there an easy way to do this using the underlying js or xml? I've done this for Dashboards by exporting/importing the underlying xml.

Note - I'm a Power User, but I'm not an admin.

Re: Easily copy alerts to multiple splunk instances

adonio — Fri, 12 Jul 2019 18:47:08 GMT

the alerts are saves in savedsearches.conf
you can copy it

Re: Easily copy alerts to multiple splunk instances

wfresch — Fri, 12 Jul 2019 18:49:32 GMT

Where would I find that file though? Can I find it from the splunk web instance? I don't have access to any raw server files.

Re: Easily copy alerts to multiple splunk instances

richgalloway — Fri, 12 Jul 2019 18:51:27 GMT

I recommend putting the alert (perhaps copied out of an existing savedsearches.conf) into its own app (also in savedsearches.conf). Then you can copy or install the app onto other Splunk instances. You will need admin rights or admin assistance to do that, however.