Is there a way to bulk edit WebHook endpoints on Splunk Alerts

[darbritto]

Hi All,

I have 300+  Splunk alerts which are pointing to webhook endpoint "A" but soon I have a migration planned for the webhook. 

All the 300 + alerts need to be edited so the webhook endpoint points to "B" I was wondering if there is an easy way of bulk editing all the alerts rather than doing it individually for each alert. 

Thanks.

[marnall]

If you are running Splunk on-prem, you can edit the alert webhooks using the filesystem. Search for your alert name in /opt/splunk/etc/apps/<appnameorall>/local/savedsearches.conf , then replace the webhook lines using your favorite text editor.

[darbritto]

@marnallThanks!  I do not have admin privileges to check the filesystems but I can check with my admins. Just curious is there one config file per alert or is it one master config file for each app within Splunk?

[marnall]

If the alerts are shared in an app, they will be in the savedsearches.conf in the app. If they are private alerts, they will be in your user directory in splunk. When in doubt, you can take a unique string from the alert like its name (if it has a unique name) and then run 'grep -r "<name>"' in the /opt/splunk/ directory to find where the alert's configuration file is.