Editing, modifing,removing an alerts



I've created an alert for a host.

It sends me an email. But I want to edit it or modifi it or delet it.

How can I do that? Where can I find this options for modifying an alerts?


Tags (1)

Ultra Champion

Manager -> Searches and Reports -> your_sourcetype:your search.

Click it and you can set/alter the alerting options. Make sure you are in the right App/user context (drop down menus at the top of the page) - otherwise you won't see your search.


Path Finder

for saved searches it's Searches and Reports -> choose_your_search -> More Info -> schedule [edit] -> next and you can finally change your "email to" settings, etc. yikes!

0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...