can i clone alerts from the UI

[nwoolley]

Thats all i need the method for cloning alerts as we migrate 

[nwoolley]

anks thought there would be a slicker way of doing this with XML ok cheers 

[gcusello]

Hi @nwoolley,

Ok, sorry but this is the only way!

Anyway, if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @nwoolley,

from the app where the alert to clone is resident open [Settings -- Searches, Reports and Alerts]

Choose the alert to clone and click "Edit" and then "Clone".

Ciao.

Giuseppe

[nwoolley]

I need to clone onto another splunk instance not the same one I should have been clearer 

[gcusello]

Hi @nwoolley,

in this case, the easiest way is to copy the search and configure the same alert in the other instance.

You could also copy the alert from $SPLUNK_HOME/etc/apps/<your_app>/local/savedsearches.conf, taking the stanza of the alert to clone and copying it in the other instance, but in my opinion it's easiest to copy the search and create the alert.

Ciao.

Giuseppe