Hi guys,
Is there any way to change the alert name in .conf files that does not need restart splunk?
In the link below I could not find the appropriate field.
http://docs.splunk.com/Documentation/Splunk/latest/admin/savedsearchesconf
In addition, I've tried in /opt/splunk/etc/users/admin/search/local/savedsearches.conf, but it is not change in real environment.
Tks.
Hi Wvalente,
Usually splunk restart for savedsearch.conf changes is not required, you have to refresh by using ,
http://<yoursplunkserver>:<your web port, default 8000>/debug/refresh
Below link will help you to understand when to restart splunk,
https://docs.splunk.com/Documentation/Splunk/6.6.2/Admin/Configurationfilechangesthatrequirerestart
Check your Splunk version and the documents for more information,
Hope this will helps you!!!