topic How can I find reports with email address. in Reporting

How can I find reports with email address.

mbhardwaj1 — Thu, 29 Jul 2021 08:53:02 GMT

Hi ,

I have a clustered environment of Slunk setup. How can I find the all reports and alerts with email address. Actually I need to correct the email domains again and I didn't found any correct way to check all reports with email address. Is there any search query and specific method to find out.

Re: How can I find reports with email address.

kamlesh_vaghela — Thu, 29 Jul 2021 10:21:57 GMT

@mbhardwaj1

Can you please try this search?

| rest /servicesNS/-/-/saved/searches | where 'action.email'="1" | table title "action.email.to"

| rest /servicesNS/-/-/saved/searches splunk_server=local | where 'action.email'="1" | table title "action.email.to"

Re: How can I find reports with email address.

venkatasri — Thu, 29 Jul 2021 10:26:55 GMT

Hi @mbhardwaj1

You can issue this rest call to find them, action.email.to field having email address. Alternatively you can find savedsearches.conf file and grep/replace the domain that you wish to from backend.

| rest "/servicesNS/-/-/saved/searches" | table id search title action.email.to

---

An upvote would be appreciated and Accept solution if this reply helps!

Re: How can I find reports with email address.

venkatasri — Thu, 29 Jul 2021 10:30:16 GMT

If you have multiple Search Heads (SH) and clustered you can push the changes to any one of the instance from SH deployer that will replicate across all cluster members. FYI, otherwise if they are not clustered you have to go modify on every instance manually.