We have a lot of saved searches and alerts. To make it easier to browse, I want rename them.
If I go to manage searches and reports and click on the search name, I'm able to only change the "Search" string.
A possible solution I found is to clone it and then just edit the "search name" string & delete the previous search.
Is this method good? I just don't want to be blamed by the whole department for spoiling the system!
While it is possible to edit the config file, you will need to restart Splunk to reread the configuration. This may be a factor to some people!
I am unable to access the URL. Getting a 500 Internal Server Error.
Also, I believe my profile type is 'user' and am not sure if i can access the config file. Would love to find a way where a business user can edit saved alerts rather than having to touch a config file.
Any updates or insights from anyone?
I really can't believe that since 2011 there is still no option to rename only the Alert title via the GUI... Is this so hard to be done?