Hi ,
I'm trying to disable an alert but while doing so I'm getting an error. can you please help in this.
Please note that I am not the owner of this alert. Is it possible that because of this I'm unable to disable it?
Could not find object id=WMS WK: Auto Wave Status Has Changed
Regards,
Rahul
Hi @rahul2gupta,
can you see this alert in alerts' list?
maybe it's a private alert not shared.
Ciao.
Giuseppe
what if it is private?
Hi @gcusello ,
Yes, I can see this alert in the alert list.
But while Disabling owner is also getting error same as me.
When I click on the alert I get the following pop up message.
Please help.
Regards,
Rahul
Hi @rahul2gupta,
probably the problem is that the alert is in system instead in an app.
So you could try to delete the alert in $SPLUNK_HOME/etc/system/local/savedsearches.conf 8and restart Splunk.
Otherwise, open a Case to Splunk Support.
Ciao.
Giuseppe