Add new code to existing alerts

[sravani27]

Hi, I have over 150 alerts to which I have to add new lines of code like below example. I am updating each alert manually and it is getting tedious. Is there a way to update all the alerts in bulk? I also want to add additional alert action (send Webex teams notification) along with the existing send email action. Can anyone please suggest a way to do it?

eg: old alert search

|makeresults | eval message="Hi How are you"

New alert search

|makeresults| eval message="Hi How are you"| eval message2= "this is message2" |eval message3="this is message3"

[richgalloway]

I'm suggesting using your favorite editor to make bulk changes within the config file(s).

Don't forget to restart the search head after editing to apply the changes.

[richgalloway]

If you have access to the CLI and the alerts are in one (or a few) app then you can use an editor to make the changes quickly.  Like this, in vim

1,$ s/|makeresults| eval message="Hi How are you"/|makeresults| eval message="Hi How are you"| eval message2= "this is message2" |eval message3="this is message3"/

The actual command will depend on how varied the alerts are.

[sravani27]

@richgalloway  Thanks for your response. Are you suggesting updating individual alerts using CLI?