Alerting

Can't remove alerts properly

CASTAND
Engager

When I use the alert manager to remove an alert, the line related to the alert cannot be removed.
However, the alert action field is set to action=alert_deleted.

I've been encountering this problem since I upgrade my splunk version from 5.0.2 to 6.0. Can this be related ?

Tags (3)

shamer
Engager

I have the same issue:
http://answers.splunk.com/answers/128245/unable-to-delete-triggered-alerts.html

I haven't found a solution.

0 Karma

dkuk
Path Finder

I noticed this issue also on v6 but am yet to work out why it happens. I thought maybe it was due to a capability being required (in Splunk roles) but there doesn't seem to be anything relating to alerts in the available list. I'll post again if I work it out though not sure what it could be currently.

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...