Splunk Search

can i clone alerts from the UI

nwoolley
Engager

Thats all i need the method for cloning alerts as we migrate 

Labels (1)
0 Karma

nwoolley
Engager

anks thought there would be a slicker way of doing this with XML ok cheers 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nwoolley,

Ok, sorry but this is the only way!

Anyway, if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nwoolley,

from the app where the alert to clone is resident open [Settings -- Searches, Reports and Alerts]

Choose the alert to clone and click "Edit" and then "Clone".

Ciao.

Giuseppe

0 Karma

nwoolley
Engager

I need to clone onto another splunk instance not the same one I should have been clearer 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nwoolley,

in this case, the easiest way is to copy the search and configure the same alert in the other instance.

You could also copy the alert from $SPLUNK_HOME/etc/apps/<your_app>/local/savedsearches.conf, taking the stanza of the alert to clone and copying it in the other instance, but in my opinion it's easiest to copy the search and create the alert.

Ciao.

Giuseppe

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!