Security

modify the saved splunk Alert using api

venugoski
Explorer
looking for help in editing the saved Alert query using the api/curl .
i would like to change the pod_count 9 to 12 . how can i do that using api/curl
alertname = test_goski-list
alert query =
index=list-service source="eventhub://sams-jupiter-prod-scus-logs-premium-1.servicebus.windows.net/list-service;" "kubernetes.namespace_name"="list-service" | stats dc(kubernetes.pod_name) as pod_count | where pod_count < 9
i am trying to run the below curl to connect to the search head IP and getting the error response.
curl -k -u admin:changeme -X POST https://10.236.140.2:8089/servicesNS/admin/search/alerts/test_goski-list -d "search=index=list-service"


<?xml version="1.0" encoding="UTF-8"?>
<response>
<messages>
<msg type="ERROR">Not Found</msg>
</messages>
</response>
Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

maybe this helps youhttps://community.splunk.com/t5/Alerting/Why-can-t-I-change-alert-with-REST-It-change-permission-fro...

It’s old answer where I change some parameters on query. I think that you could change the query just like those parameters on conf.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...