Add/Update email in alert

[AlokPanday]

I have created a search which is working fine. It sends an email when the alert condition meets.

My question is, is there any way I can add/update the email address in my alert using curl command?

also can I update my alert search query using curl command?

Thanks,

Regards,

[Gr0und_Z3r0]

You can create a search and send email to any email address you want using the sendemail function.
This can be only done by using the Splunk's REST API. 
You can create custom REST endpoints if needed in Splunk to cater certain functions.

Also explore the Splunk's Java and Python SDK.

Sharing some resources to explore and refer

https://dev.splunk.com/enterprise/docs/devtools/customrestendpoints/
https://docs.splunk.com/Documentation/Splunk/8.2.3/RESTREF/RESTlist 
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail 
https://docs.splunk.com/Documentation/Splunk/8.2.3/RESTTUT/RESTsearches 
https://dev.splunk.com/enterprise/docs/devtools/java/sdk-java/ 

[isoutamo]

Hi

that's work like @Gr0und_Z3r0 said. For curiosity, what it the problem which you are trying to solve? Just wondering is there any other way to solve it.

r. Ismo

[AlokPanday]

Hi

Thanks, @Gr0und_Z3r0  for the replay.

@isoutamo I have created an alert in Splunk and I want to create a user interface from where I can update the alert like

curl --location --request POST 'https://localhost:8089/servicesNS/nobody/MP/saved/searches/test4' \

--data-urlencode 'description=Test4 alert' \

--data-urlencode 'alert.severity=4' \

--data-urlencode 'dispatch.earliest_time=-20m' \

--data-urlencode 'dispatch.latest_time=now' \

--data-urlencode 'cron_schedule=*/5 * * * *'

user will be able to update the fields from Interface.

Thank you..