Alerting

Is there an easy way to use the REST API to disable Splunk alerts during a maintenance window?

titleistfour
Explorer

Hello,

Is there an easy way to use the API to disable Splunk alerts during a maintenance window? Say for instance, disable the Send Email action for the alert via Rest API.

Any suggestions?

Thanks,
Jay

Tags (2)
0 Karma
1 Solution

titleistfour
Explorer

This might help someone in the future who needs to use Curl.

To disable email for an alert
curl -k -u admin:pass https://splunkserver:8089/servicesNS/nobody/search/saved/searches/MyAlert1 -d "actions="

To enable email for an alert
curl -k -u admin:pass https://splunkserver:8089/servicesNS/nobody/search/saved/searches/MyAlert1 -d "actions=email"

View solution in original post

titleistfour
Explorer

This might help someone in the future who needs to use Curl.

To disable email for an alert
curl -k -u admin:pass https://splunkserver:8089/servicesNS/nobody/search/saved/searches/MyAlert1 -d "actions="

To enable email for an alert
curl -k -u admin:pass https://splunkserver:8089/servicesNS/nobody/search/saved/searches/MyAlert1 -d "actions=email"

pretzel2
Path Finder

Is a Splunk restart required after making this call?

0 Karma

srisplunk12
Engager

@titleistfour does this apply if we are triggering alert notifications from Splunk through Microsoft outlook as well ? also if we disable during the maintenance ,do they get stored an trigger in bulk once we setup the connection after maintenance?

0 Karma

titleistfour
Explorer

Looks like I just need to use the API to send

POST saved/searches/{name} with actions = rss for the parameters to disable.
POST saved/searches/{name} with actions = rss,email for the parameters to enable.

I think.

Jay

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...