Alerting

How to set default admin ownership for all new alerts to savedsearches.conf?

mufthmu
Path Finder

Hi,

I want to automatically set ownership to admin whenever new alerts are added in savedsearches.conf.

As of now, whenever my team has a new alert I have to add it to the savedsearches.conf AND also local.meta to make it owned by admin with the exact same title written in savedsearches.conf (if it does not match, it doesn't take effect) like the stanza below:

[savedsearches/new alert]
owner = admin

However, I don't want to keep editing 2 different files when 1 alert is created (too much work if we have a lot of new incoming alerts).

There should be a way to set default ownership of alerts (and also dashboards) to admin when they're first created.
I suspect default.meta has something to do with it.

Looking for any suggestion,
Thank you

Labels (1)
0 Karma

ragedsparrow
Contributor

By default the owner will be whomever creates the alert/saved search. You can change owner through the configs like you've mentioned, but you can also reassign knowledge objects in the UI (starting with Splunk 7) :

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Resolveorphanedsearches#Use_the_Reassig...

I don't believe there is a way to automatically change the owner of a knowledge object without this type of intervention.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...