Alerting
Highlighted

Why do the alerts not have a delete or schedule option in the search head?

Splunk Employee
Splunk Employee

The customer has 3 search heads in a cluster environment, they have pushed savedsearches.conf from the deployer. Now they are unable to delete or schedule those alerts via Splunk web, it is grayed out

0 Karma
Highlighted

Re: Why do the alerts not have a delete or schedule option in the search head?

Splunk Employee
Splunk Employee

I'm answering my own question:

When you push the savedsearches from the deployer, it will become Baseline knowledge objects for search head where you cannot move, share or schedule via splunk web. This is default splunk behaviour. For information on baseline objects please refer below document.

http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Manage...

View solution in original post