topic Re: fetch alerts created by a particular user using REST API in Alerting

fetch alerts created by a particular user using REST API

santosh_bwn — Tue, 09 Jun 2020 01:13:56 GMT

Hi,

I am trying to fetch the alerts created by a particular user using REST APIs. How can i filter it?
Generally on UI, under alerts, there will be a yours tab which shows alerts created by me. How can i achieve similar thing using REST API(for myself or any other user).

Thanks,
Santosh

Re: fetch alerts created by a particular user using REST API

Sfry1981 — Thu, 14 May 2020 08:40:10 GMT

Hi Santosh,

When you say fetch are you looking at the REST command directly via the UI in splunk or an external tool?

Re: fetch alerts created by a particular user using REST API

santosh_bwn — Thu, 14 May 2020 09:38:11 GMT

Using external tool postman.

Re: fetch alerts created by a particular user using REST API

Sfry1981 — Thu, 14 May 2020 09:56:17 GMT

i use postman for modular input time to time with splunk but i have splunk cloud so it will be different to yours but the below should work.

Make a GET to https://:/services/alerts/alert_actions

this should bring back the whole xml you need of ll the saved searches. After this to filter you may need to write a test script to filter what you need via variables so you would have to set up a new environment to capture these variables

Re: fetch alerts created by a particular user using REST API

santosh_bwn — Thu, 14 May 2020 11:25:28 GMT

Thanks. Will check this approach

Re: fetch alerts created by a particular user using REST API

harsmarvania57 — Thu, 14 May 2020 11:43:56 GMT

Hi,

You can use below REST API to fetch particular user saved searches.

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID")

If you want to search for particular user and from particular app then use below query

https://<your_splunk_instance>:8089/servicesNS/-/-/saved/searches?search=(eai:acl.owner="USERID") AND (eai:acl.app="App_Folder_Name")