modify the saved splunk Alert using api

[venugoski]

looking for help in editing the saved Alert query using the api/curl .
i would like to change the pod_count 9 to 12 . how can i do that using api/curl

alertname = test_goski-list
alert query =

index=list-service source="eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;" "kubernetes.namespace_name"="list-service" | stats dc(kubernetes.pod_name) as pod_count | where pod_count < 9

i am trying to run the below curl to connect to the search head IP and getting the error response.

curl -k -u admin:changeme -X POST https://10.236.140.2:8089/servicesNS/admin/search/alerts/test_goski-list -d "search=index=list-service"

<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Not Found</msg>
</messages>
</response>

[isoutamo]

Hi

maybe this helps youhttps://community.splunk.com/t5/Alerting/Why-can-t-I-change-alert-with-REST-It-change-permission-fro...

It’s old answer where I change some parameters on query. I think that you could change the query just like those parameters on conf.

r. Ismo