Fix Error while deleting an alert?

[rahul2gupta]

Hi  ,

I'm trying to disable an alert but while doing so I'm getting an error. can you please help in this.

Please note that I am not the owner of this alert. Is it possible that because of this I'm unable to disable it?

Could not find object id=WMS WK: Auto Wave Status Has Changed

Regards,

Rahul

[rahul2gupta]

Thank you @gcusello .

we have logged a case with the splunk support.

Regards,

Rahul

[gcusello]

Hi @rahul2gupta,

you can disable an alert if you are the owner or an administrator.

Ciao.

Giuseppe

[rahul2gupta]

Hi @gcusello ,

I'm an admin but still unable to disable the alert.

Regards,

Rahul

[gcusello]

Hi @rahul2gupta,

can you see this alert in alerts' list?

maybe it's a private alert not shared.

Ciao.

Giuseppe

[iamsahil]

what if it is private?

[rahul2gupta]

Hi @gcusello ,

Yes, I can see this alert in the alert list.

But while Disabling owner is also getting error same as me.

When I click on the alert I get the following pop up message.

Please help.

Regards,

Rahul

[gcusello]

Hi @rahul2gupta,

probably the problem is that the alert is in system instead in an app.

So you could try to delete the alert in $SPLUNK_HOME/etc/system/local/savedsearches.conf 8and restart Splunk.

Otherwise, open a Case to Splunk Support.

Ciao.

Giuseppe