Reporting

How to edit the email address for all scheduled searches and reports in a single App without editing each one by one?

marees123
Path Finder

Hi Experts,

I have an APP which contains more than 170 reports and searches. Need to edit the email address for all searches and reports. Is there any way to edit it for all reports in a single shot instead of editing one by one?

Thanks

1 Solution

LukeMurphey
Champion

You can do this with the sendemail search command and macros. Macro references are replaced before the search executes and thus changing the macro will change all of the searches that use the macro.

Here are steps to use it:

Step 1: create a macro that defines the email addresses

Create a macro that contains the email addresses. You can do this in the manager under Settings » Advanced search » Search macros » New.

Your macro might look something like this in the file-system:

[email_addresses]
definition = nouser@fakemail.com
iseval = 0

Step 2: use the macro with sendemail in your searches

Modify your search to use sendemail along with the macro. Below is an example:

* | head 1 | sendemail `email_addresses`

In this example, the macro will expand to:

* | head 1 | sendemail nouser@fakemail.com

View solution in original post

joxley
Path Finder

If you're on a *nix machine, you can use some command line fu and sed to do this:

sed --in-place 's/old@example.com/new@example.com/' savedsearches.conf 

If you're on Windows, from PowerShell

(Get-Content .\savedsearches.conf) -replace "old@example.com", "new@example.com" | Set-Content .\savedsearches.conf

marees123
Path Finder

thanks joxley....

0 Karma

srajakash
New Member

we have lot of savedsearches.conf. Can you please provide the exact path for the same?

0 Karma

LukeMurphey
Champion

You can do this with the sendemail search command and macros. Macro references are replaced before the search executes and thus changing the macro will change all of the searches that use the macro.

Here are steps to use it:

Step 1: create a macro that defines the email addresses

Create a macro that contains the email addresses. You can do this in the manager under Settings » Advanced search » Search macros » New.

Your macro might look something like this in the file-system:

[email_addresses]
definition = nouser@fakemail.com
iseval = 0

Step 2: use the macro with sendemail in your searches

Modify your search to use sendemail along with the macro. Below is an example:

* | head 1 | sendemail `email_addresses`

In this example, the macro will expand to:

* | head 1 | sendemail nouser@fakemail.com

marees123
Path Finder

Thank you:-)

0 Karma

stephanefotso
Motivator

NO NO NO !
Each scheduled search is independent to another. In such case you must edit each search, to add your email address

Thanks

SGF

marees123
Path Finder

Thank you 🙂

0 Karma

stephanefotso
Motivator

Edit the email address how? what is the relation between your reports and your email address?

SGF
0 Karma

marees123
Path Finder

We scheduled searches and some reports. And the results will be delivered to some recipients through email. Now i would like to include an email address for all the searches and reports. I dont want to edit each and every single report and add the email address.... this is the scenario.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...