Alerting

Easily copy alerts to multiple splunk instances

wfresch
Explorer

I need to create the same alert for several splunk instances. Is there an easy way to do this using the underlying js or xml? I've done this for Dashboards by exporting/importing the underlying xml.

Note - I'm a Power User, but I'm not an admin.

adonio
Ultra Champion

the alerts are saves in savedsearches.conf
you can copy it

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I recommend putting the alert (perhaps copied out of an existing savedsearches.conf) into its own app (also in savedsearches.conf). Then you can copy or install the app onto other Splunk instances. You will need admin rights or admin assistance to do that, however.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

wfresch
Explorer

Where would I find that file though? Can I find it from the splunk web instance? I don't have access to any raw server files.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!