Reporting

How to edit the email address for all scheduled searches and reports in a single App without editing each one by one?

marees123
Path Finder

Hi Experts,

I have an APP which contains more than 170 reports and searches. Need to edit the email address for all searches and reports. Is there any way to edit it for all reports in a single shot instead of editing one by one?

Thanks

1 Solution

LukeMurphey
Champion

You can do this with the sendemail search command and macros. Macro references are replaced before the search executes and thus changing the macro will change all of the searches that use the macro.

Here are steps to use it:

Step 1: create a macro that defines the email addresses

Create a macro that contains the email addresses. You can do this in the manager under Settings » Advanced search » Search macros » New.

Your macro might look something like this in the file-system:

[email_addresses]
definition = nouser@fakemail.com
iseval = 0

Step 2: use the macro with sendemail in your searches

Modify your search to use sendemail along with the macro. Below is an example:

* | head 1 | sendemail `email_addresses`

In this example, the macro will expand to:

* | head 1 | sendemail nouser@fakemail.com

View solution in original post

joxley
Path Finder

If you're on a *nix machine, you can use some command line fu and sed to do this:

sed --in-place 's/old@example.com/new@example.com/' savedsearches.conf 

If you're on Windows, from PowerShell

(Get-Content .\savedsearches.conf) -replace "old@example.com", "new@example.com" | Set-Content .\savedsearches.conf

marees123
Path Finder

thanks joxley....

0 Karma

srajakash
New Member

we have lot of savedsearches.conf. Can you please provide the exact path for the same?

0 Karma

LukeMurphey
Champion

You can do this with the sendemail search command and macros. Macro references are replaced before the search executes and thus changing the macro will change all of the searches that use the macro.

Here are steps to use it:

Step 1: create a macro that defines the email addresses

Create a macro that contains the email addresses. You can do this in the manager under Settings » Advanced search » Search macros » New.

Your macro might look something like this in the file-system:

[email_addresses]
definition = nouser@fakemail.com
iseval = 0

Step 2: use the macro with sendemail in your searches

Modify your search to use sendemail along with the macro. Below is an example:

* | head 1 | sendemail `email_addresses`

In this example, the macro will expand to:

* | head 1 | sendemail nouser@fakemail.com

marees123
Path Finder

Thank you:-)

0 Karma

stephanefotso
Motivator

NO NO NO !
Each scheduled search is independent to another. In such case you must edit each search, to add your email address

Thanks

marees123
Path Finder

Thank you 🙂

0 Karma

stephanefotso
Motivator

Edit the email address how? what is the relation between your reports and your email address?

0 Karma

marees123
Path Finder

We scheduled searches and some reports. And the results will be delivered to some recipients through email. Now i would like to include an email address for all the searches and reports. I dont want to edit each and every single report and add the email address.... this is the scenario.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...