Easily copy alerts to multiple splunk instances

[wfresch]

I need to create the same alert for several splunk instances. Is there an easy way to do this using the underlying js or xml? I've done this for Dashboards by exporting/importing the underlying xml.

Note - I'm a Power User, but I'm not an admin.

[adonio]

the alerts are saves in savedsearches.conf
you can copy it

[richgalloway]

I recommend putting the alert (perhaps copied out of an existing savedsearches.conf) into its own app (also in savedsearches.conf). Then you can copy or install the app onto other Splunk instances. You will need admin rights or admin assistance to do that, however.

[wfresch]

Where would I find that file though? Can I find it from the splunk web instance? I don't have access to any raw server files.