topic Re: Cataloging Report Notification Actions in Splunk Search

Cataloging Report Notification Actions

deaseec — Thu, 18 Feb 2021 21:59:24 GMT

I am looking to catalog which reports/alerts utilize which notification actions. I have a search currently that keys off of, "alert_action", but this is only effective IF the alert has already fired off in the specified time frame. However, I need to be able to see any alerts that will take a given action, even if they have not fired off. Any help is greatly appreciated.

Re: Cataloging Report Notification Actions

tscroggins — Sun, 21 Feb 2021 00:25:47 GMT

@deaseec

You can query searches and actions using the REST API.

| rest /servicesNS/-/-/saved/searches count=0 splunk_server=local
| foreach action.*
[| eval alert_actions=mvappend(alert_actions, case('<<FIELD>>'==1 AND match("<<FIELD>>", "^action\.[^.]+$"), "<<FIELD>>"))]
| fields splunk_server eai:acl.app title author alert_actions
| search alert_actions=*

Actions have field names like action.foo.

Action parameters have field names like action.foo.bar.

In this example, I've used foreach to iterate over field names and add them to a multi-valued field named alert_actions if 1) the value is 1 and 2) the field is not a parameter.

Re: Cataloging Report Notification Actions

deaseec — Mon, 22 Feb 2021 16:08:25 GMT

That worked PERFECTLY! Thank you for your help.