Reporting

How to update 'To' Address Field for Bulk Email Alerts

sunilbaba
New Member

Hi All,

I need to update the Bulk Splunk Saved Alerts To email Address. Is there any way that i can update all alerts at a time instead of doing manual work by opening each and every alerts

Thanks in Advance

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can update the savedsearches.con file from the filesystem (e.g. for NIX OS, use sed or similar command to replace To attribute for all searches. Other more control option would be to use Splunk's REST API Endpoints to update it (you would need some sort of wrapper script to fetch, loop through all saved search and update the required attribute. See this http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D)

0 Karma

sunilbaba
New Member

Hi Somesoni,

Can you please elaborate the use case of updating through REST API . can you please provide the REST Services for this.

i have my splunk URL and user ,password credentails is it sufficent to use the rest services to update through rest serv ice.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you expand the GET section for this link, you'd see the example curl command to get the list of saved searches.
http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches

Then by looping through the results, you can run the curl command as suggested in POST sectionof the below link.
http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTsearch#saved.2Fsearches.2F.7Bname.7D

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...