All,
So I just installed the Alert Manager, but I don't think this question is per se Alert_manager specific. How would I get an email notification of moves/add/changes in the alerts for this app context?
https://myamazingserver/en-US/app/alert_manager/alerts
Say my NOC changes a frequency or a DL?
Hi daniel333,
you could check the splunkd_access
and splunk_web_access
log for POST
requests, see this run everywhere search:
index=_internal action=edit POST sourcetype=splunk_web_access OR sourcetype=splunkd_access | table user ns file
and create an alert out of it.
But this will only capture changes done in the Splunk UI, if someone replaces the savedsearches.conf
on the server you will not see any events in there.
Hope this helps ...
cheers, MuS