https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233160#M69205 <P>In most cases, yes you can, as they are saved searches. The <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.4.1/User/SearchesReportsAlerts">Splunk Cloud User Manual</A> is a great place to start, and there is also the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts">Alerting Manual</A>.</P> Thu, 18 Aug 2016 22:07:33 GMT dshpritz 2016-08-18T22:07:33Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233159#M69204 <P>Can you alter the Splunk search used for an alert? I don't see any way to alter it.</P> <P>I am being asked to choose a product. From the About box in our local Splunk website, it lists Cloud, so I am selecting that.</P> Thu, 18 Aug 2016 20:41:30 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233159#M69204 marnee 2016-08-18T20:41:30Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233160#M69205 <P>In most cases, yes you can, as they are saved searches. The <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.4.1/User/SearchesReportsAlerts">Splunk Cloud User Manual</A> is a great place to start, and there is also the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Alert/Aboutalerts">Alerting Manual</A>.</P> Thu, 18 Aug 2016 22:07:33 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233160#M69205 dshpritz 2016-08-18T22:07:33Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233161#M69206 <P>Sure! You are looking for <A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/UsingManagertoupdateandexpandalertfunctionality#Edit_an_alert_search">Edit an alert search</A> in the <EM>Alerting Manual</EM>.</P> Thu, 18 Aug 2016 23:06:25 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233161#M69206 ChrisG 2016-08-18T23:06:25Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233162#M69207 <P>Is it possible to update the alert query without recreating the alert. When I edit the alert query it is not giving the option to "Save". It give the option to "Save As", that lead us to create a new alert.,Every time when I make the changes on alert query, it forced me to save as different query / different alert. Is there any way I can modify the existing query instead of creating different alert every time ?</P> Fri, 17 Apr 2020 13:04:31 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233162#M69207 cstamilarasan 2020-04-17T13:04:31Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233163#M69208 <P>If you have permissions, view the alert, click the edit button, choose Open in Search. Make the changes to the query and execute the search. You should then be able to click save.,</P> Thu, 23 Apr 2020 16:38:37 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233163#M69208 masonbanhammer 2020-04-23T16:38:37Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233164#M69209 <P>Yes, you just need to run the query after you make the edits, the save button should then be available</P> Thu, 23 Apr 2020 16:43:02 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233164#M69209 masonbanhammer 2020-04-23T16:43:02Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233165#M69210 <P>Thanks for this clear answer on my very old question (when I was a newbie).</P> <P>Splunk is awesome, but nothing is perfect. That way of altering the search query is so unintuitive that it still annoys me. Nobody I've worked with has ever been able to figure out how to edit a search query for an alert on their own. </P> <P>A person shouldn't have to go to a manual for such a basic operation.</P> <P>An improvement would be: Instead of "Open in Search", the text "Edit Search Query" would be much, much better. And then when it opens in Search, it should somehow look very different from normal search (e.g. different background color, make Save buttons much more prominent)</P> <P>Maybe one day when I'm feeling ambitious, I'll figure out how and will send a suggestion to Splunk for that change, but what's the point? Most companies don't listen to such suggestions, no matter how good a company (and so many companies are forgetting about usability and about intuitive and efficient UIs these days).</P> Wed, 06 May 2020 19:07:51 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/233165#M69210 marnee 2020-05-06T19:07:51Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/593155#M206453 <P>That total worked.&nbsp; And wasn't intuitive...</P> Fri, 08 Apr 2022 18:21:56 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/593155#M206453 rogerdpack 2022-04-08T18:21:56Z https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/598950#M208531 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/59065">@cstamilarasan</a>&nbsp;&nbsp;You have to run the query after you edit it in order for the "Save" option to show.&nbsp;</P><P>It took me a while to figure that out.</P> Mon, 23 May 2022 17:37:38 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-alter-the-Splunk-search-used-for-an-alert/m-p/598950#M208531 WillTheOnly 2022-05-23T17:37:38Z