Alerting

Can I change alert name in .conf without restarting Splunk?

Explorer

Hi guys,

Is there any way to change the alert name in .conf files that does not need restart splunk?

In the link below I could not find the appropriate field.

http://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf

In addition, I've tried in /opt/splunk/etc/users/admin/search/local/savedsearches.conf, but it is not change in real environment.

Tks.

0 Karma

Motivator

Hi Wvalente,

Usually splunk restart for savedsearch.conf changes is not required, you have to refresh by using ,

http://<yoursplunkserver>:<your web port, default 8000>/debug/refresh

Below link will help you to understand when to restart splunk,

https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Configurationfilechangesthatrequirerestart

Check your Splunk version and the documents for more information,

Hope this will helps you!!!