Splunk Enterprise

Add new code to existing alerts

sravani27
Path Finder

Hi, I have over 150 alerts to which I have to add new lines of code like below example. I am updating each alert manually and it is getting tedious. Is there a way to update all the alerts in bulk? I also want to add additional alert action (send Webex teams notification) along with the existing send email action. Can anyone please suggest a way to do it?

eg: old alert search

|makeresults | eval message="Hi How are you"

New alert search

|makeresults| eval message="Hi How are you"| eval message2= "this is message2" |eval message3="this is message3"

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm suggesting using your favorite editor to make bulk changes within the config file(s).

Don't forget to restart the search head after editing to apply the changes.

---
If this reply helps you, an upvote would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

If you have access to the CLI and the alerts are in one (or a few) app then you can use an editor to make the changes quickly.  Like this, in vim

1,$ s/|makeresults| eval message="Hi How are you"/|makeresults| eval message="Hi How are you"| eval message2= "this is message2" |eval message3="this is message3"/

The actual command will depend on how varied the alerts are.

---
If this reply helps you, an upvote would be appreciated.

sravani27
Path Finder

@richgalloway  Thanks for your response. Are you suggesting updating individual alerts using CLI? 

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>