Splunk Enterprise

How to easily copy alerts to another instance?


Using Splunk Enterprise (currently 7.3.x here); I'm not an admin, so cannot see/change "savedsearches.conf".

I have over a dozen alerts (with more to come) that I need to copy from our pre-production Splunk search head to production (where I would edit the details).

I would expect a simple "export" menu choice somewhere in the Alerts page or on a particular Alert, but there's nothing remotely similar.

The Splunk "apps" already exist on both, and differ, so I couldn't ask some admin to just copy it.

Given that the search terms, cron schedule, time span, trigger condition, and actions are all separate, it is a major amount of work to copy & paste (with multiple additional clicks). 


Labels (1)


PS: I sincerely suggest that a product manager (or equivalent) at Splunk try doing this, in person, for several non-trivial alerts (with multiple actions).

It is a very common, error-prone, and much complained-about activity at our site.


Have you check if this is already proposed on ideas.splunk.com? If not, maybe you should add it there!

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...