How to update 'To' Address Field for Bulk Email Alerts

[sunilbaba]

Hi All,

I need to update the Bulk Splunk Saved Alerts To email Address. Is there any way that i can update all alerts at a time instead of doing manual work by opening each and every alerts

Thanks in Advance

[somesoni2]

You can update the savedsearches.con file from the filesystem (e.g. for NIX OS, use sed or similar command to replace To attribute for all searches. Other more control option would be to use Splunk's REST API Endpoints to update it (you would need some sort of wrapper script to fetch, loop through all saved search and update the required attribute. See this http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D)

[sunilbaba]

Hi Somesoni,

Can you please elaborate the use case of updating through REST API . can you please provide the REST Services for this.

i have my splunk URL and user ,password credentails is it sufficent to use the rest services to update through rest serv ice.

[somesoni2]

If you expand the GET section for this link, you'd see the example curl command to get the list of saved searches.
http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches

Then by looping through the results, you can run the curl command as suggested in POST sectionof the below link.
http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D