A smart way to disable email alert for all saved searches

[shangshin]

Hi,
I have hundreds of saved searches for monitors running in the search heads frequently 24 * 7. Is there a way to disable all email alert for all saved searches when I am doing maintenance work on the indexers e.g. restarting. It's quite annoying to get false alarms due to failed searches.

Thanks in advance.

[eric_chg]

Question : Empty entry at Mail host field and require any service restarting after saved "Mail Server settings" ?

[eric_chg]

Question : Remove "Mail host" record and require any service restarting after saved ?

[lukejadamec · Accepted solution]

Yes. Go to Manager >> System Settings >> Email alert settings and remove the Mail Host information (just remember what it was so you can put it back when you're done).

[MuS]

Take a look at this answer http://answers.splunk.com/answers/65828/inhibiting-alerts-from-saved-searches-that-had-search-errors...

It was valid for all pre Splunk 6 sendemail.py scripts. For the Splunk 6.x scripts I have to test it first.

[shangshin]

Make sense. So it will require change on the python script that is used to send email.

E.g. Exit the email python program is the message Level is ERROR

[lukejadamec]

In the case of failed searches I believe it has to do with the trigger for the alert, but I'll have to test it.

[shangshin]

Thank you. I just gave it a try and it's working. This can be used for planned change.
I wish there is a way that email alert won't go out to the recipients due to failed search.