Is there a way to replicate all the alerts present in one environment(prod) to another environment(non-prod)

[vineela]

Is there a way to replicate all the alerts present in one environment(production) to another environment(non-prod). where as both are present in same place i mean url is same but indexes of both environments is different. And the main thing is we cannot access backend as we have only limited access.
Can anyone please help me through it in achieving it.

Thanks in Advance

[gcusello]

Hi @vineela,

if you used the best practice to use eventtype to address the indexes in each search it's easy because you have to change the index name only one time, otherwise, you have to change them one by one.

A way ro be faster could be, if you have all your alerts in one (or few) app, could be to copy the savedsearches.conf file (the full file or at least only the interesting alerts) from the production environement to the non production environemnt (restarting Splunk!), but this solution doesn't solve the first problem.

Ciao.

Giuseppe