Alerting
Highlighted

how to edit the title after alert saved?

Motivator

Could anyone please suggest how to edit the alert title after the alert got saved

Labels (2)
Tags (1)
0 Karma
Highlighted

Re: how to edit the title after alert saved?

It's possible (but a bit of a kludge) to edit this directly in the configuration files. But the easiest way to do this is to clone the alert - giving the clone the name you want - and then delete the original alert. That's what I usually do.

View solution in original post

Highlighted

Re: how to edit the title after alert saved?

Motivator

Thanks..currently i am doing the same thing

0 Karma
Highlighted

Re: how to edit the title after alert saved?

Legend

@elliotproebstel while this could be easiest way to do it from the UI. Another approach would be to rename the alert in the savedsearches.conf file and then refresh or restart splunk.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: how to edit the title after alert saved?

Don't you also need to edit the related metadata file? I'm often nervous that there's a thread from one conf file to another that I'm failing to keep in sync when I go that route.

0 Karma
Highlighted

Re: how to edit the title after alert saved?

Legend

No not required 🙂




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: how to edit the title after alert saved?

Good to know, thanks! I'll try to remember that.

0 Karma
Highlighted

Re: how to edit the title after alert saved?

@niketnilay Are you sure about that?
If you rename a search in savedsearches.conf that have specific metadata in local.meta for example, there is no way the renamed search will inherit the same metadata.

Highlighted

Re: how to edit the title after alert saved?

Legend

Ok so while cloning gives an option to Clone the permissions however, this approach means local.meta file settings for the alert would also need to be copied or manually edit the permissions from front end.




| eval message="Happy Splunking!!!"


Highlighted

Re: how to edit the title after alert saved?

Oh alright, so you were talking about cloning in the first place? Sorry i did not realise.
I would expect cloning to also clone the permissions.
However manual edit of the savedsearches.conf would require to change the name of the object in metadata stanza as well.