Alerting

Why do the alerts not have a delete or schedule option in the search head?

bpadmanbhachari
Splunk Employee
Splunk Employee

The customer has 3 search heads in a cluster environment, they have pushed savedsearches.conf from the deployer. Now they are unable to delete or schedule those alerts via Splunk web, it is grayed out

0 Karma
1 Solution

bpadmanbhachari
Splunk Employee
Splunk Employee

I'm answering my own question:

When you push the savedsearches from the deployer, it will become Baseline knowledge objects for search head where you cannot move, share or schedule via splunk web. This is default splunk behaviour. For information on baseline objects please refer below document.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Manage...

View solution in original post

bpadmanbhachari
Splunk Employee
Splunk Employee

I'm answering my own question:

When you push the savedsearches from the deployer, it will become Baseline knowledge objects for search head where you cannot move, share or schedule via splunk web. This is default splunk behaviour. For information on baseline objects please refer below document.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Manage...

altink
Contributor

How does one delete the Alert when there is no Delete option in the Alert's Edit Menu?

 

best

Altin

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...