Can I change alert name in .conf without restarting Splunk?


Hi guys,

Is there any way to change the alert name in .conf files that does not need restart splunk?

In the link below I could not find the appropriate field.

In addition, I've tried in /opt/splunk/etc/users/admin/search/local/savedsearches.conf, but it is not change in real environment.


0 Karma


Hi Wvalente,

Usually splunk restart for savedsearch.conf changes is not required, you have to refresh by using ,

http://<yoursplunkserver>:<your web port, default 8000>/debug/refresh

Below link will help you to understand when to restart splunk,

Check your Splunk version and the documents for more information,

Hope this will helps you!!!