Is there a way to disable email alerts for multiple Splunk alerts during a maintenance window?

[xewaso626]

We use Splunk Enterprise and would like to know if there a way if we can disable email alerts for multiple Splunk alerts. I dont want to manually disable each alert  during that window.

Is there a curl command that I can run so that multiple alerts are disabled?

Can I feed all the alerts in a .csv and a command which will pull the alert names and disable them all at once?

@titleistfour ? 

Referring to your thread: https://community.splunk.com/t5/Alerting/Is-there-an-easy-way-to-use-the-REST-API-to-disable-Splunk/...

https://stackoverflow.com/questions/51799979/splunk-disabling-alerts-during-maintenance-window 

[titleistfour]

We still disable alerts one at a time.  But we use Ansible and a loop to accomplish it for multiple alerts.  Works just fine.  Although, for our use case it's usually only a few alerts that we need to disable for each playbook.

/t

[xewaso626]

@titleistfour : Thank you for your answer. Can you share some thread on how we can do it using Ansible? Just to get a heads-up.

PS: I am still discovering about Ansible 

[titleistfour]

It's just a simple REST call with the URI module, basically the same thing curl is doing

- name: Update Splunk service
  uri:
     url: "{{ splunk_scheme }}://{{ splunk_server }}:{{ splunk_port }}//servicesNS/nobody/search/saved/searches/{{ item }}"
     method: POST
     force_basic_auth: yes
     user: "{{ splunk_username }}"
     password: "{{ splunk_password }}"
     body: "disabled={{ action }}"
  delegate_to: localhost
  loop: "{{ splunk_alerts }}"

Just send it a list of "splunk_alerts" and the action of "enable" or "disable".  That's it.

/t

[dadol24553]

@titleistfour that is good and simple way, but is there a way that we can include a .csv as input for the Queries to be disabled?  I am just curious to know can we create a .bash file that runs and just pulls the data from a .csv?

@xewaso626 : The best way is to just disable the entire email alerting if there are too many alerts. I know there are few policies which don't allow to do so, but wanted to let you know just incase.

[titleistfour]

I have no idea if you can use a CVS that way.  Just use a bash script to loop line by line and call curl each line.

/t