Reporting

How to update 'To' Address Field for Bulk Email Alerts

sunilbaba
New Member

Hi All,

I need to update the Bulk Splunk Saved Alerts To email Address. Is there any way that i can update all alerts at a time instead of doing manual work by opening each and every alerts

Thanks in Advance

Tags (1)
0 Karma

somesoni2
Revered Legend

You can update the savedsearches.con file from the filesystem (e.g. for NIX OS, use sed or similar command to replace To attribute for all searches. Other more control option would be to use Splunk's REST API Endpoints to update it (you would need some sort of wrapper script to fetch, loop through all saved search and update the required attribute. See this http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D)

0 Karma

sunilbaba
New Member

Hi Somesoni,

Can you please elaborate the use case of updating through REST API . can you please provide the REST Services for this.

i have my splunk URL and user ,password credentails is it sufficent to use the rest services to update through rest serv ice.

0 Karma

somesoni2
Revered Legend

If you expand the GET section for this link, you'd see the example curl command to get the list of saved searches.
http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches

Then by looping through the results, you can run the curl command as suggested in POST sectionof the below link.
http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...