How to set up an alert email notification for any moves, adds, or changes in the alerts for this app context?

[daniel333]

All,

So I just installed the Alert Manager, but I don't think this question is per se Alert_manager specific. How would I get an email notification of moves/add/changes in the alerts for this app context?

https://myamazingserver/en-US/app/alert_manager/alerts

Say my NOC changes a frequency or a DL?

[MuS]

Hi daniel333,

you could check the splunkd_access and splunk_web_access log for POST requests, see this run everywhere search:

index=_internal action=edit POST sourcetype=splunk_web_access OR sourcetype=splunkd_access | table user ns file

and create an alert out of it.
But this will only capture changes done in the Splunk UI, if someone replaces the savedsearches.conf on the server you will not see any events in there.

Hope this helps ...

cheers, MuS