Setting a default action for alert in splunk

kteng2024 · ‎05-03-2017

HI,

Is there anyway in splunk to set the "email" as default trigger action for an alert.

somesoni2 · ‎05-03-2017

You can use [default] stanza in savedsearches.conf to assign an attribute to all saved searches. You can use attributes described in below link to setup your email alert.

http://docs.splunk.com/Documentation/Splunk/6.5.3/Admin/Savedsearchesconf#Settings_for_email_action

Please note that this will get applied to all scheduled searches (unless overridden at search level).

kteng2024 · ‎05-03-2017

Can i set the webhook as default trigger action as in the documentation i see only for email.

Setting a default action for alert in splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Setting a default action for alert in splunk

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future