topic Re: Filter saved searches for Alerts in Splunk Dev

Filter saved searches for Alerts

tmontney — Wed, 10 Jun 2020 20:46:05 GMT

Using the API, I cannot tell the difference between reports and alerts. How do I distinguish? A parameter in my request? A property returned in the response?

https://mysplunkserver.local:8089/servicesNS/-/-/saved/searches?count=0

Re: Filter saved searches for Alerts

twesty — Thu, 11 Jun 2020 21:01:45 GMT

You should be able to use the alert_condition field for for this.

Check out the link here for more info on the endpoint 🙂

Re: Filter saved searches for Alerts

tmontney — Fri, 12 Jun 2020 14:03:35 GMT

What values are acceptable for alert_condition? It's blank for all my saved searches. I think this is "Trigger Conditions" where it's set to Custom. I don't have that in any of my alerts.

Re: Filter saved searches for Alerts

twesty — Fri, 12 Jun 2020 14:14:26 GMT

I'd take a look at your REST results and see which fields in action.* are the safest to work with for you. Unfortunately there isnt a field which states THIS IS AN ALERT. There really should be given the UI has such a clear separation between Alerts and Reports and the architecture behind the scenes stores the config in the same place... but that's another conversation for another time 😀

Re: Filter saved searches for Alerts

tmontney — Fri, 12 Jun 2020 14:29:52 GMT

For email, action.email.subject.alert works. Seems like it's only available for alerts. For other alert actions, nothing I can find that distinguishes them.

Re: Filter saved searches for Alerts

twesty — Fri, 12 Jun 2020 14:54:12 GMT

that would work. Just bear in mind that only relying on that one field as your condition will fail if you create an alert which does not send an email