Alerts

[SN1]

I have admin role in splunk , I was able to edit alert searches before but now i am not able to do so.

SN1_0-1776324569849.png

[livehybrid]

Hi @SN1 

Can you open the Developer tools in your browser and click on the Network tab? Then can you try and make the change/sabe and see what the status code of the POST request is? Does the response tab show an error message?

When making changes in this way I believe the search is sent to the parser endpoint and it could be that its failing to validate, or something else.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[ITWhisperer]

What permissions do you have set up for the alert?

ITWhisperer_0-1776326337662.png

[SN1]

SN1_0-1776326583468.png

[isoutamo]

Based on that this is shared to everyone with write permission you should have those accesses.

Is this on prem or SCP environment? Based on listed roles I’m expecting on prem.

Is there been any updates or other changes in your environment?

What are your versions, os etc?

any other issues in your environment?

And have you any errors on internal logs after you have tried to save it?