topic can i clone alerts from the UI in Splunk Search

can i clone alerts from the UI

nwoolley — Wed, 31 Mar 2021 16:25:09 GMT

Thats all i need the method for cloning alerts as we migrate

Re: can i clone alerts from the UI

gcusello — Wed, 31 Mar 2021 16:28:14 GMT

Hi @nwoolley,

from the app where the alert to clone is resident open [Settings -- Searches, Reports and Alerts]

Choose the alert to clone and click "Edit" and then "Clone".

Ciao.

Giuseppe

Re: can i clone alerts from the UI

nwoolley — Wed, 07 Apr 2021 08:17:02 GMT

I need to clone onto another splunk instance not the same one I should have been clearer

Re: can i clone alerts from the UI

gcusello — Wed, 07 Apr 2021 08:44:37 GMT

Hi @nwoolley,

in this case, the easiest way is to copy the search and configure the same alert in the other instance.

You could also copy the alert from $SPLUNK_HOME/etc/apps/<your_app>/local/savedsearches.conf, taking the stanza of the alert to clone and copying it in the other instance, but in my opinion it's easiest to copy the search and create the alert.

Ciao.

Giuseppe

Re: can i clone alerts from the UI

nwoolley — Wed, 07 Apr 2021 08:46:31 GMT

anks thought there would be a slicker way of doing this with XML ok cheers

Re: can i clone alerts from the UI

gcusello — Thu, 08 Apr 2021 06:49:12 GMT

Hi @nwoolley,

Ok, sorry but this is the only way!

Anyway, if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉