Are you a member of the Splunk Community?
- Find Answers
- :
- Premium Solutions
- :
- Splunk Enterprise Security
- :
- Re: cannot find saved alert in enterprise security...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have saved a search query as an alert on enterprise security app, but i cannot find them in alerts tab ( search & reporting) , aslo I checked under content management tab, and I cannot find there also. so, please some one help me where do i find those alerts in enterprise security ? as I need to delete them as I created as a real time alert and i m getting continues emails.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
If you are not sure in which app you saved that alert, then you can search in all app, go to Settings -> Searches, reports and alerts -> Under App dropdown select all and you can search your scheduled search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
If you are not sure in which app you saved that alert, then you can search in all app, go to Settings -> Searches, reports and alerts -> Under App dropdown select all and you can search your scheduled search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
no thats I already tried, i cannot find there. I have checked in following tabs in Search & Reporting ...alerts ..."all" "your" and This App's".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please check here Settings -> Searches, reports and alerts -> Under App dropdown select all and you can search your scheduled search , because this contains alerts & reports both however tabs in Search & Reporting ...alerts contain only alert.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks a lot, I found them.
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
