I have 100 alerts configured with certain condition, I have to change the condition but don't want to go to every alert and change the condition instead change in 1 place and it should change in all the places

[amit2301]

I have 100 alerts configured with certain condition, I have to change the condition but don't want to go to every alert and change the condition instead change in 1 place and it should change in all the places

[cmerriman]

the fastest way that i've found is to go into the savedsearches.conf and find all the stanzas that you need to change and do a find and replace.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Alert/Configuringalertsinsavedsearches.conf