Alerting

Splunk Alerting: Identify all the alerts which are using same webhook

arkapdas
Engager
hi all, I have a specific webhook url which has been used in multiple splunk alerts. Now I want to change that webhook. I was trying to figure out, is there any way I can figure out what are the alerts which are using this particular webhook
Labels (1)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @arkapdas 

The following command shall return the alerts and their actions you have to find what's the field name for webhook and further filter it to your need.

| rest  /services/saved/searches | where isnotnull(title) | table action* id title search

 

View solution in original post

arkapdas
Engager

You saved my life, now I am pushing it a little more [:P]

Is there any way  I can update the values  in one shot?

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@arkapdas goto savedsearches.conf on SH and update them from backend.

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @arkapdas 

The following command shall return the alerts and their actions you have to find what's the field name for webhook and further filter it to your need.

| rest  /services/saved/searches | where isnotnull(title) | table action* id title search

 

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...