topic Re: How to use REST API for Alerts in Other Usage

How to use REST API for Alerts

Travis_Stanley — Wed, 11 Oct 2023 15:35:41 GMT

Hi, I'm trying to use the REST API to get and post saved searches that are Alerts but for some reason it only returns data for Reports. Has anyone else had this problem?

GET

https://<host>:<mPort>/services/saved/searches

https://<host>:<mPort>/services/saved/searches/{name}

Re: How to use REST API for Alerts

_JP — Wed, 11 Oct 2023 16:47:53 GMT

This is how I have been able to access these things via REST.

The first thing you need to make sure is you have the "Add to Triggered Alerts" Alert Action that you want to be see these in the GUI or REST. By default, Splunk will run alerts you configure, but won't necessarily "track" them unless you explicitly tell it to. It looks like this in the GUI:

Once you add that Alert Action and some alerts fire, you'll see the triggered events in the GUI and via this REST endpoint:

/alerts/fired_alerts/

Once you're getting your list of triggered alerts, then you can find the sid value within the data returned and then use the other REST endpints to fetch stuff for the actual search that was ran. Here's a screenshot of a bit of the output from the above rest endpoint on my test environment:

Also - note that the Expire setting for the alert will control how long Splunk keeps those results around for those sids:

Re: How to use REST API for Alerts

Travis_Stanley — Thu, 12 Oct 2023 07:44:00 GMT

Hi @_JP , Thanks for the reply but that's not what I'm looking for. I want the ability to list and create alerts, not view triggered alerts.

Re: How to use REST API for Alerts

Travis_Stanley — Thu, 12 Oct 2023 09:58:14 GMT

Specifically listing them using the GET is proving troublesome. When I search the returned results, I don't find all alerts, but I do find all reports.

The POST to create and alert is not an issue.