Alerting

How can we move alerts from one app to another?

Path Finder

Hi,

We need to move few alerts from one app to another, is there a way we can do this?

Thanks

Esteemed Legend

What a GREAT selection of answers! Make sure that you pick the one that worked best for you and up-vote any that worked at all.

Contributor
0 Karma

Motivator

hi splunker9999,

all alerts are setup in your savedsearches.conf (there could by multiple files!) you must check for any action.* items, because this will define an alert. Copy all the stanza alerts that you want to move into a new savedsearches.conf file, then copy and paste the file into your target application (in the default directory or local).

then you restarted splunk and everything will work.

for more informations about savedsearches or savedsearches.conf, see this link:

http://docs.splunk.com/Documentation/Splunk/6.3.3/Alert/Configuringalertsinsavedsearches.conf

0 Karma

Motivator

Hi
In Splunk web , go to Setting- -> Searches, reports, and alerts in Actions column click on clone of your existing alert, in open form choose your new app in Destination app ** dropdown and **save

Esteemed Legend

Assuming that you do not have CLI access to your Search Head and that you do not have a Deployment Server, then, if you have several in one app and need to move them to another app you can export both apps using the app exporter tool, hand merge them and then upgrade the app with the merged app zip/tgz file:

https://splunkbase.splunk.com/app/2613/

0 Karma

SplunkTrust
SplunkTrust

Hi,

You can see "Move" button for that alert in Setting -> Searches, reports, and alerts and select new application.

Thanks,
Harshil

SplunkTrust
SplunkTrust

Just to update, if anyone want to move mutiple knowledge objects from one app to another then it'll be pain in Splunk WebGUI because you need to move knowledge object one by one, to simplified this I have created python script which uses Splunk REST API to move multiple knowledge objects https://github.com/harsmarvania57/splunk-ko-change (NOTE: Please use that script at your own risk :P)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!