topic Re: Does a search variable in filter exception within search command require special handling? in Alerting

Does a search variable in filter exception within search command require special handling?

pm771 — Thu, 28 Jul 2022 21:23:05 GMT

This is my 2nd follow-up regarding this solution: https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/m-p/...

My question now is about the search field (that contains the actual Splunk query behind each alert). Does this field require any special handling?

If I need to use this field for filtering purposes inside a search command, would it be different than using any other field like title.

Or can I simply use something like following:

|rest/servicesNS/-/-/saved/searches | search alert.track=1 AND title="prefix*" AND search="index=someindex*"

Re: Search variable in filter exception within search command

richgalloway — Thu, 28 Jul 2022 18:02:34 GMT

When you run a query without a leading | character you are running an implicit search command. Explicit search commands are very much the same.

Re: Does a search variable in filter exception within search command require special handling?

pm771 — Thu, 28 Jul 2022 21:44:34 GMT

@richgalloway

I understand that. My question was specific to search field that that is a part of REST call return.

Is REST call similar to sub-search in regards to the special meaning of search field?

Like something similar to https://community.splunk.com/t5/Splunk-Search/Subsearch-fields-quot-query-quot-quot-search-quot-How-do-I-know/m-p/62422?

Re: Does a search variable in filter exception within search command require special handling?

richgalloway — Fri, 29 Jul 2022 00:34:15 GMT

It's just a field. There's nothing wrong or special about

| search search=foo