How to easily copy alerts to another instance?

[larrywest]

Using Splunk Enterprise (currently 7.3.x here); I'm not an admin, so cannot see/change "savedsearches.conf".

I have over a dozen alerts (with more to come) that I need to copy from our pre-production Splunk search head to production (where I would edit the details).

I would expect a simple "export" menu choice somewhere in the Alerts page or on a particular Alert, but there's nothing remotely similar.

The Splunk "apps" already exist on both, and differ, so I couldn't ask some admin to just copy it.

Given that the search terms, cron schedule, time span, trigger condition, and actions are all separate, it is a major amount of work to copy & paste (with multiple additional clicks). 

[larrywest]

PS: I sincerely suggest that a product manager (or equivalent) at Splunk try doing this, in person, for several non-trivial alerts (with multiple actions).

It is a very common, error-prone, and much complained-about activity at our site.

[isoutamo]

Have you check if this is already proposed on ideas.splunk.com? If not, maybe you should add it there!

r. Ismo