update_alert
Update an existing Splunk alert by modifying search, schedule, or trigger conditions. Requires prior documentation consultation and verifies write access before changes.
Instructions
Update an existing alert. Pre-checks edit access; refuses if can_write is false. Requires docsConsulted=true. DOCUMENTATION-FIRST: read the official Splunk docs (use the splunk_docs tool) before writing SPL or a dashboard definition; do not guess syntax or schema.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| app | No | App namespace. Default: the alert's current app. | |
| cron | No | Cron schedule. | |
| name | Yes | Existing alert name. | |
| owner | No | Owner. Default: the alert's current owner. | |
| latest | No | Dispatch latest time. | |
| search | Yes | New SPL. | |
| actions | No | Alert actions. | |
| earliest | No | Dispatch earliest time. | |
| condition | No | Trigger type (see create_alert). | |
| threshold | No | Numeric threshold. | |
| comparator | No | Comparator (see create_alert). | |
| description | No | Optional description. | |
| docsConsulted | Yes | Must be true. | |
| docsReference | No | The doc URL/section you used. | |
| customCondition | No | SPL condition for condition='custom'. |