Problem Solving : How to update splunk alerts/saved searches using Python SDK

In this video I have discussed about a very specific use case where we can use splunk python SDK to update vast number of alerts/saved searches in one go.

Python SDK API Reference :

Search API end points :

Code used in this tutorial can be downloaded from the below repo,

[amosart]

Thanks for the sharing! Also tried to count for the presenter's word "OK" 🙂

[krishnamalleboina]

Hi
Thanks for the video.
How do you send an alert to Distribution list <DL> instead of adding each and every recipient.?

[Sandeep]

Do we have any video on creating alerts, scheduling them, and see them triggered. I mean basically from starting to end of alert cycle by using Python sdk

[venugoski]

Hi, can we update the splunk Alert query using SDK

[rajkumarkandasamy]

Hello Siddharth,
Thanks for the
I have a use case, I have created the code to disable and enable the Splunk alerts dynamically based on the Splunk alert names in a lookup file.
I wanted the python code to be executed in the Splunk environment without manually running it. I don't want to go with the cron schedule at the OS level as this script is for Splunk cloud.
can we create a Splunk alert that can trigger this python code every 10 min?
as this is not a custom command, I cant call this via the custom commands approach. Also, i cant call this via scripted input as we are not indexing anything here.
Any inputs from you is highly

[mamathapanabaka]

Hi sidhartha, i have multiple .log files in another tool and i need to move them in splunk by writing python script, can you help me .. can you make a video

[sravankumar]

Thanks for your videos, Can you please post the video on the topic : splunk alerts which will raise service now incident whenever Splunk alert is triggered.

[Royalityfree]

Hi could you please do a video on how to write splunk search using python 3 or above using our own user if and password and run it at constant interval

[AbhishekVerma-hxbq]

Thank you so much Sid for this video, really appreciate your efforts.
2 query I have -
1. what will be host in service method when using splunk cloud, will it be the url from where I login to splunk.
2. Suppose I have to filter all those alerts which are schedule to run at 9am in an app then how can we get those ?

[maciasalvasalva]

Hi sir, I have a question for you. I'm trying to modify only comment for one alert. How can I do that? Do you have a video that makes something like that?
My code:

import splunklib.client as client

service = client.connect(host=self.HOST_API, port=self.PORT_API, username=self.USARNAME_API, password=self.PASSW_API)
incidents = client.Incidents(service)
all_incidents = incidents.incidents
incident_id =
incident =
incident.update(comment="New comment for the alert")



Thank you !