How to edit list of people receiving alerts in Splunk Ent. please. Thank u in advance

[SamHTexas]

There are Alerts going to certain people that don't want to receive such alerts any more. Thanks

[gcusello]

Hi @SamHTexas,

please try his:

| rest /servicesNS/-/-/saved/searches splunk_server=local 
| table title action.email.to

Ciao.

Giuseppe

[SamHTexas]

Bro, we have a few alerts that sends email to a few people. A few people don't want to receive these alerts any more. How to remove their names from the list of recipients? Gracias. 

[burwell]

Run the command Guissepe provided. Each title is an alert. Edit the alert and find the alert action which is an email alert. Edit the email action or remove the email action.

[gcusello]

Hi @SamHTexas,

using my search, you can find which are the alerts to modify, so you have to open each one and delete the sendmail.

Using this search you can see also the app where the alert is created:

| rest /servicesNS/-/-/saved/searches splunk_server=local
| table title action.email.to request.ui_dispatch_app

Ciao.

Giuseppe