The customer has 3 search heads in a cluster environment, they have pushed savedsearches.conf from the deployer. Now they are unable to delete or schedule those alerts via Splunk web, it is grayed out
When you push the savedsearches from the deployer, it will become Baseline knowledge objects for search head where you cannot move, share or schedule via splunk web. This is default splunk behaviour. For information on baseline objects please refer below document.
When you push the savedsearches from the deployer, it will become Baseline knowledge objects for search head where you cannot move, share or schedule via splunk web. This is default splunk behaviour. For information on baseline objects please refer below document.
