- Splunk Answers
- :
- Using Splunk
- :
- Alerting
- :
- A smart way to disable email alert for all saved s...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have hundreds of saved searches for monitors running in the search heads frequently 24 * 7. Is there a way to disable all email alert for all saved searches when I am doing maintenance work on the indexers e.g. restarting. It's quite annoying to get false alarms due to failed searches.
Thanks in advance.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. Go to Manager >> System Settings >> Email alert settings and remove the Mail Host information (just remember what it was so you can put it back when you're done).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Question : Empty entry at Mail host field and require any service restarting after saved "Mail Server settings" ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Question : Remove "Mail host" record and require any service restarting after saved ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. Go to Manager >> System Settings >> Email alert settings and remove the Mail Host information (just remember what it was so you can put it back when you're done).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Take a look at this answer http://answers.splunk.com/answers/65828/inhibiting-alerts-from-saved-searches-that-had-search-errors...
It was valid for all pre Splunk 6 sendemail.py scripts. For the Splunk 6.x scripts I have to test it first.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Make sense. So it will require change on the python script that is used to send email.
E.g. Exit the email python program is the message Level is ERROR
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the case of failed searches I believe it has to do with the trigger for the alert, but I'll have to test it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you. I just gave it a try and it's working. This can be used for planned change.
I wish there is a way that email alert won't go out to the recipients due to failed search.
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
