Reporting

How to find and shut off emailed report from Splunk?

njbuche
New Member

We had a owner of a report that left the company. I cloned that report so we would still receive the email. Someone else also cloned the report so I deleted the report that I cloned. Now we are still getting an email from the deleted report that I cloned. I need to find out how to find the report (since its deleted) and shut off the duplicate email.

0 Karma
1 Solution

jscraig2006
Communicator

You can go into the app itself SPLUNK_HOME/etc/apps/app_name/local/savedserarches.conf and delete it from there. You will have to restart Splunk for the change to take affect. It could have been set to private in which you would not see it in the GUI.

View solution in original post

0 Karma

njbuche
New Member

Thank you for your help. I was able to get with our Splunk admin and had them remove the job and disable that job from the app.

0 Karma

jscraig2006
Communicator

You can go into the app itself SPLUNK_HOME/etc/apps/app_name/local/savedserarches.conf and delete it from there. You will have to restart Splunk for the change to take affect. It could have been set to private in which you would not see it in the GUI.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...