topic Re: renaming saved alerts in Splunk Search

renaming saved alerts

aniketb — Wed, 01 Aug 2012 19:23:07 GMT

Hi,

We have a lot of saved searches and alerts. To make it easier to browse, I want rename them.

If I go to manage searches and reports and click on the search name, I'm able to only change the "Search" string.
A possible solution I found is to clone it and then just edit the "search name" string & delete the previous search.

Is this method good? I just don't want to be blamed by the whole department for spoiling the system!

Re: renaming saved alerts

sdaniels — Wed, 01 Aug 2012 19:37:54 GMT

You could edit the names directly in the appropriate config file rather than cloning and deleting. Take a look at this.

http://splunk-base.splunk.com/answers/35617/rename-and-grouping-saved-searches

Re: renaming saved alerts

ff_rumali — Wed, 04 Oct 2017 19:31:16 GMT

While it is possible to edit the config file, you will need to restart Splunk to reread the configuration. This may be a factor to some people!

Re: renaming saved alerts

tsvetan — Thu, 22 Mar 2018 15:10:02 GMT

I really can't believe that since 2011 there is still no option to rename only the Alert title via the GUI... Is this so hard to be done?

Re: renaming saved alerts

kamalanc — Fri, 13 Apr 2018 15:04:52 GMT

I am unable to access the URL. Getting a 500 Internal Server Error.
Also, I believe my profile type is 'user' and am not sure if i can access the config file. Would love to find a way where a business user can edit saved alerts rather than having to touch a config file.
Any updates or insights from anyone?
thank you

Re: renaming saved alerts

pellegrini — Tue, 25 Aug 2020 07:47:28 GMT

Restarting splunk is not required.

It is enough to refresh the config.

To reload your endpoints type the following into your browser:

http://<yoursplunkserver>:8000/en-US/debug/refresh

Ref: https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Configurationfilechangesthatrequirerestart#...