topic Re: Error while deleting an alert in Splunk Search

Fix Error while deleting an alert?

rahul2gupta — Mon, 20 Feb 2023 19:44:44 GMT

Hi ,

I'm trying to disable an alert but while doing so I'm getting an error. can you please help in this.

Please note that I am not the owner of this alert. Is it possible that because of this I'm unable to disable it?

Could not find object id=WMS WK: Auto Wave Status Has Changed

Regards,

Rahul

Re: Error while deleting an alert

gcusello — Tue, 17 Nov 2020 07:32:20 GMT

Hi @rahul2gupta,

you can disable an alert if you are the owner or an administrator.

Ciao.

Giuseppe

Re: Error while deleting an alert

rahul2gupta — Wed, 18 Nov 2020 06:14:59 GMT

Hi @gcusello ,

I'm an admin but still unable to disable the alert.

Regards,

Rahul

Re: Error while deleting an alert

gcusello — Wed, 18 Nov 2020 12:32:39 GMT

Hi @rahul2gupta,

can you see this alert in alerts' list?

maybe it's a private alert not shared.

Ciao.

Giuseppe

Re: Error while deleting an alert

rahul2gupta — Fri, 20 Nov 2020 05:16:38 GMT

Hi @gcusello ,

Yes, I can see this alert in the alert list.

But while Disabling owner is also getting error same as me.

When I click on the alert I get the following pop up message.

Please help.

Regards,

Rahul

Re: Error while deleting an alert

gcusello — Fri, 20 Nov 2020 07:24:19 GMT

Hi @rahul2gupta,

probably the problem is that the alert is in system instead in an app.

So you could try to delete the alert in $SPLUNK_HOME/etc/system/local/savedsearches.conf 8and restart Splunk.

Otherwise, open a Case to Splunk Support.

Ciao.

Giuseppe

Re: Error while deleting an alert

rahul2gupta — Fri, 20 Nov 2020 11:49:48 GMT

Thank you @gcusello .

we have logged a case with the splunk support.

Regards,

Rahul

Re: Error while deleting an alert

iamsahil — Mon, 20 Feb 2023 07:21:14 GMT

what if it is private?