Building for the Splunk Platform

How do you disable a search validation when creating an alert?

joemaz95
Path Finder

I'm transferring an alert from one Splunk instance to another via REST api. The alert contains a custom search command, but the new Splunk doesn't have the search command set yet. When I try to create the alert, I get an error saying "http 400 bad request - Search factory: unknown search command." Is there any way to turn off the validation that's identifying the lack of a search command here? Thanks in advance.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hey @joemaz95 , did you solve your problem? If you keep us updated on your progress, you have a better chance of getting your question answered.

Also, If you want to try to get some immediate help for your question, you could join the 5000+ Splunk users in our public Slack Community chat. People ask each other for immediate help on there daily. You can share your question/link to your post there to see if anyone can take a stab at it.

You first have to request access through https://splk.it/slack Fill out the form, and once you receive the approval email from our Community Manager (usually the approval process may take a couple days), you can access Slack.com and ask for help in the #general channel.

0 Karma

joemaz95
Path Finder

Thanks for your input! I haven't made much headway with my issue, so maybe I'll give the slack chat a try.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Why not create the search command first?

---
If this reply helps you, Karma would be appreciated.
0 Karma

joemaz95
Path Finder

The search command that I need to create has another dependency that wont be set up yet, so I was hoping to create the search before waiting for this domino effect to be set off.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...