splunk: View the alerts created by another user

kimberlytrayson — Tue, 17 Mar 2020 15:18:19 GMT

We are using splunk enterprise in our organization. Is it possible to view the alerts created by another user?

I went to

Reports and Dashboards -> Alerts

Clicked on All. Searched for the other user's name in the searchbox but no results come up.

Thanks for reading.

Re: splunk: View the alerts created by another user

woodcock — Tue, 17 Mar 2020 17:07:36 GMT

Try this:

|rest/servicesNS/-/-/saved/searches splunk_server=local
| where 'alert.track'="1" AND ('eai:acl.owner' = "sumguy" OR owner = "sumguy")
| dedup id
| rename dispatch.* AS *
| rename eai:acl.* AS *
| table owner sharing title search description* *
| sort 0 title

And, just in case somebody comes here expecting alert to mean something else, here is that answer, too:

| rest /servicesNS/-/-/alerts/fired_alerts/- splunk_server=local
| addinfo
| where trigger_time >= info_min_time
| table trigger_time author eai:acl.owner eai:acl.app savedsearch_name sid eai:acl.sharing digest_mode id published *
| rename eai:acl.* AS *
| search author="sumguy" OR owner="sumguy"

topic splunk: View the alerts created by another user in Alerting

splunk: View the alerts created by another user

Re: splunk: View the alerts created by another user