https://community.splunk.com/t5/Alerting/How-to-create-a-shared-alert-via-REST-API/m-p/502127#M8950 <P>You do this via a different endpoint than the alarm creation. My script:</P> <P>```<BR /> curl -v -k -u "$SPLUNK_USER:$SPLUNK_PASSWORD" \<BR /> "https://$DOMAIN:8089/services/saved/searches/$ALARM_NAME/acl" \<BR /> --data-urlencode sharing="app" \<BR /> --data-urlencode output_mode="json" \<BR /> --data-urlencode owner="$SPLUNK_USER" \<BR /> --data-urlencode perms.read="<EM>" \<BR /> --data-urlencode perms.write="</EM>"</P> <P>```</P> <P>This grants read and write permissions to everyone in the 'app' sharing thing.</P> Wed, 30 Sep 2020 02:51:03 GMT justinabrahms 2020-09-30T02:51:03Z https://community.splunk.com/t5/Alerting/How-to-create-a-shared-alert-via-REST-API/m-p/502125#M8948 <P>Hello everyone!</P> <P>I had a great doubt about creating alerts using Splunk Rest API.</P> <P>Every of them are shared only for the owner/creator after been created.</P> <P>How can I create a shared alert with my group of users using the Rest API?</P> Tue, 15 Oct 2019 18:46:29 GMT https://community.splunk.com/t5/Alerting/How-to-create-a-shared-alert-via-REST-API/m-p/502125#M8948 mlopesn 2019-10-15T18:46:29Z https://community.splunk.com/t5/Alerting/How-to-create-a-shared-alert-via-REST-API/m-p/502126#M8949 <P>You do this via a different endpoint than the alarm creation. My script:</P> <P>```<BR /> curl -v -k -u "$SPLUNK_USER:$SPLUNK_PASSWORD" \<BR /> "https://$DOMAIN:8089/services/saved/searches/$ALARM_NAME/acl" \<BR /> --data-urlencode sharing="app" \<BR /> --data-urlencode output_mode="json" \<BR /> --data-urlencode owner="$SPLUNK_USER" \<BR /> --data-urlencode perms.read="<EM>" \<BR /> --data-urlencode perms.write="</EM>"</P> <P>```</P> <P>This grants read and write permissions to everyone in the 'app' sharing thing.</P> Wed, 30 Sep 2020 02:51:00 GMT https://community.splunk.com/t5/Alerting/How-to-create-a-shared-alert-via-REST-API/m-p/502126#M8949 justinabrahms 2020-09-30T02:51:00Z https://community.splunk.com/t5/Alerting/How-to-create-a-shared-alert-via-REST-API/m-p/502127#M8950 <P>You do this via a different endpoint than the alarm creation. My script:</P> <P>```<BR /> curl -v -k -u "$SPLUNK_USER:$SPLUNK_PASSWORD" \<BR /> "https://$DOMAIN:8089/services/saved/searches/$ALARM_NAME/acl" \<BR /> --data-urlencode sharing="app" \<BR /> --data-urlencode output_mode="json" \<BR /> --data-urlencode owner="$SPLUNK_USER" \<BR /> --data-urlencode perms.read="<EM>" \<BR /> --data-urlencode perms.write="</EM>"</P> <P>```</P> <P>This grants read and write permissions to everyone in the 'app' sharing thing.</P> Wed, 30 Sep 2020 02:51:03 GMT https://community.splunk.com/t5/Alerting/How-to-create-a-shared-alert-via-REST-API/m-p/502127#M8950 justinabrahms 2020-09-30T02:51:03Z