Alerting

How to filter alerts which contains invalid attribute or invalid attribute name

New Member

Some of the alert's attribute name has been changed hence those alerts cannot be triggered.
I want to find out such alerts. Currently, I am thinking to check each alert one by one which is tedious and long path since I have hundreds of alerts.
Is there any way Splunk can give me a list of such alerts?
If someone encounters such issues and resolves then please help us.

0 Karma

Motivator

If you have access to back-end (SSH access to Splunk search head), you can find Splunk alerts in below configuration file(s).

$SPLUNK_HOME/etc/apps/<appname>/local
$SPLUNK_HOME/etc/users/<username>/<appname>/local

0 Karma