Alerting

Bulk update action email trigger

rafamss
Contributor

Is there some way (bulk is better) to update the email field in the alert action trigger through the search/rest?

Labels (2)

inventsekar
SplunkTrust
SplunkTrust

Hi @rafamss .. it should be possible. 

1. the alerts are stored as regular (xml i think) files. find out the list of all alerts

2. the alert got field for email list, find out that field. 

3. thru vi editor / sed / awk, you can do search and replace all the required email ids. 

 

Check this first in dev/test before trying it on prod. The real challenge is that how to verify only the required email id's are replaced.. you should be able to figure it out during the step 3 actually. 

hope this gave some ideas to you, thanks. 

0 Karma

shusseina
Engager

Hi @inventsekar 

When do I find the XML for an alert?

Thanks

Steve

0 Karma

rafamss
Contributor

Hi @inventsekar,

Thank you for the response. I'll try it later in a lab and go back here to tell you if it works.

Thanks,

RS

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...