Alert permissions

Alerts are knowledge objects with defined permissions. User roles and capabilities determine alert creation, usage, editing, and other permissions.

By default, only users with the Admin or Power roles can do the following.

• Create alerts.
• Run real-time searches.
• Schedule searches.
• Save searches.
• Share alerts.

Authorized users can share an alert with other app users by editing the alert permissions. When sharing an alert with a user without the Admin or Power role, the user needs permission to access the alerting features. For example, a user needs the capability to run a real-time search in order to access a real-time alert.

Admins can configure alert action permissions to change what alert actions are available to users in a particular app. For more information, see Alert Action Permissions.

Alerts can only run with the permissions of their owner, unlike unscheduled reports, which can run with the permissions of either their owner or their user.

See Determine whether to run reports as the report owner or report user in the Reporting Manual.

Sharing an alert

You can configure sharing preferences when creating an alert or edit alert permissions later. Here are the steps for editing alert permissions.

1. Navigate to the Alerts page in the Search and Reporting app.
2. Find the alert you want to share and select Edit > Edit Permissions.
3. Share the alert by configuring which users can access it. Here are the options.

Option	Sharing description
Owner	Makes the alert private to the alert creator.
App	Display the alert for all users of the app.
All apps	Display the alert for all users of this Splunk deployment.

4. Select read and write permissions for the user roles listed.
   • Read: Users can see the alert on the Alerts page and run the alert in the app.
   • Write: Users with appropriate permissions can modify, enable, and disable the alert.