Splunk Alerting: Identify all the alerts which are using same webhook

[arkapdas]

hi all, I have a specific webhook url which has been used in multiple splunk alerts. Now I want to change that webhook. I was trying to figure out, is there any way I can figure out what are the alerts which are using this particular webhook

[arkapdas]

You saved my life, now I am pushing it a little more [:P]

Is there any way  I can update the values  in one shot?

[venkatasri]

@arkapdas goto savedsearches.conf on SH and update them from backend.

[venkatasri · Accepted solution]

Hi @arkapdas 

The following command shall return the alerts and their actions you have to find what's the field name for webhook and further filter it to your need.

| rest  /services/saved/searches | where isnotnull(title) | table action* id title search