Alerting

Is there an easy way to use the REST API to disable Splunk alerts during a maintenance window?

titleistfour
Explorer

Hello,

Is there an easy way to use the API to disable Splunk alerts during a maintenance window? Say for instance, disable the Send Email action for the alert via Rest API.

Any suggestions?

Thanks,
Jay

Tags (2)
0 Karma
1 Solution

titleistfour
Explorer

This might help someone in the future who needs to use Curl.

To disable email for an alert
curl -k -u admin:pass https://splunkserver:8089/servicesNS/nobody/search/saved/searches/MyAlert1 -d "actions="

To enable email for an alert
curl -k -u admin:pass https://splunkserver:8089/servicesNS/nobody/search/saved/searches/MyAlert1 -d "actions=email"

View solution in original post

titleistfour
Explorer

This might help someone in the future who needs to use Curl.

To disable email for an alert
curl -k -u admin:pass https://splunkserver:8089/servicesNS/nobody/search/saved/searches/MyAlert1 -d "actions="

To enable email for an alert
curl -k -u admin:pass https://splunkserver:8089/servicesNS/nobody/search/saved/searches/MyAlert1 -d "actions=email"

pretzel2
Path Finder

Is a Splunk restart required after making this call?

0 Karma

srisplunk12
Engager

@titleistfour does this apply if we are triggering alert notifications from Splunk through Microsoft outlook as well ? also if we disable during the maintenance ,do they get stored an trigger in bulk once we setup the connection after maintenance?

0 Karma

titleistfour
Explorer

Looks like I just need to use the API to send

POST saved/searches/{name} with actions = rss for the parameters to disable.
POST saved/searches/{name} with actions = rss,email for the parameters to enable.

I think.

Jay

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...