Edit an alert

[iherb_0718]

Splunkers,

I created a simple alert and now I want to go back and edit the search.  Within the ALERTS, I find the alert and then click "EDIT ALERT".  I don't see anywhere that shows me the original search.   I don't want to have to delete the alert and recreate a new one with the proper search. 

I have also tried DISABLING the alert to see if I then get the option to Edit the search but it does not.

Is this normal or am I missing something?

I am using Splunk Cloud.

[scelikok · Accepted solution]

Hi @iherb_0718,

You have two options to edit an alert;

1- Clicking "Open in Search" to edit the search of an alert. On new window you should see Save and Save As  options.

2- Go to Settings | "Searches, reports, and alerts" | Type--> Alerts | Edit Alert 

If this reply helps you an upvote is appreciated.