Hi, I have over 150 alerts to which I have to add new lines of code like below example. I am updating each alert manually and it is getting tedious. Is there a way to update all the alerts in bulk? I also want to add additional alert action (send Webex teams notification) along with the existing send email action. Can anyone please suggest a way to do it?
eg: old alert search
|makeresults | eval message="Hi How are you"
New alert search
|makeresults| eval message="Hi How are you"| eval message2= "this is message2" |eval message3="this is message3"
I'm suggesting using your favorite editor to make bulk changes within the config file(s).
Don't forget to restart the search head after editing to apply the changes.
If you have access to the CLI and the alerts are in one (or a few) app then you can use an editor to make the changes quickly. Like this, in vim
1,$ s/|makeresults| eval message="Hi How are you"/|makeresults| eval message="Hi How are you"| eval message2= "this is message2" |eval message3="this is message3"/
The actual command will depend on how varied the alerts are.
@richgalloway Thanks for your response. Are you suggesting updating individual alerts using CLI?