Alerting

A smart way to disable email alert for all saved searches

shangshin
Builder

Hi,
I have hundreds of saved searches for monitors running in the search heads frequently 24 * 7. Is there a way to disable all email alert for all saved searches when I am doing maintenance work on the indexers e.g. restarting. It's quite annoying to get false alarms due to failed searches.

Thanks in advance.

Tags (2)
1 Solution

lukejadamec
Super Champion

Yes. Go to Manager >> System Settings >> Email alert settings and remove the Mail Host information (just remember what it was so you can put it back when you're done).

View solution in original post

eric_chg
Loves-to-Learn

Question : Empty entry at Mail host field and require any service restarting after saved "Mail Server settings" ?

0 Karma

eric_chg
Loves-to-Learn

Question : Remove "Mail host" record and require any service restarting after saved ?

0 Karma

lukejadamec
Super Champion

Yes. Go to Manager >> System Settings >> Email alert settings and remove the Mail Host information (just remember what it was so you can put it back when you're done).

MuS
SplunkTrust
SplunkTrust

Take a look at this answer http://answers.splunk.com/answers/65828/inhibiting-alerts-from-saved-searches-that-had-search-errors...

It was valid for all pre Splunk 6 sendemail.py scripts. For the Splunk 6.x scripts I have to test it first.

0 Karma

shangshin
Builder

Make sense. So it will require change on the python script that is used to send email.

E.g. Exit the email python program is the message Level is ERROR

0 Karma

lukejadamec
Super Champion

In the case of failed searches I believe it has to do with the trigger for the alert, but I'll have to test it.

0 Karma

shangshin
Builder

Thank you. I just gave it a try and it's working. This can be used for planned change.
I wish there is a way that email alert won't go out to the recipients due to failed search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...