https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362633#M160575 <P>Its not giving expected results.</P> <P>Would like to search for one index and for this index would like to know alerts, saved searches configured by using this index.</P> Fri, 23 Jun 2017 14:31:29 GMT srinivasup 2017-06-23T14:31:29Z https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362631#M160573 <P>Can anyone help me to get all saved searches/alerts configured using particular index .</P> Fri, 23 Jun 2017 13:15:56 GMT https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362631#M160573 srinivasup 2017-06-23T13:15:56Z https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362632#M160574 <P>This will do it BUT there is a problem:</P> <PRE><CODE>| rest /servicesNS/-/-/saved/searches | table search title | rex max_match=0 field=search "(?&lt;=^|\s|\[)index\s*=\s*(?&lt;index&gt;(?:\"[^\"]+\")|\S+)" | rex field=index mode=sed "s/\"//g" | fillnull value="N/A" index | stats values(title) BY index </CODE></PRE> <P>The problem is that it does not handle any cases where <CODE>index</CODE> is not specified literally inside the search string. These cases include: <CODE>|savedsearch</CODE>, <CODE>|loadjob</CODE>, <CODE>eventtypes</CODE>, <CODE>macros</CODE> <CODE>tags</CODE>, the use of <CODE>Indexes searched by default</CODE> (which may vary depending on <CODE>user</CODE> and <CODE>role</CODE>) and probably other things that I am missing. Also note that <CODE>values</CODE> (and <CODE>limit</CODE>) are limited to a maximum of 1000 values.</P> Fri, 23 Jun 2017 13:52:14 GMT https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362632#M160574 woodcock 2017-06-23T13:52:14Z https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362633#M160575 <P>Its not giving expected results.</P> <P>Would like to search for one index and for this index would like to know alerts, saved searches configured by using this index.</P> Fri, 23 Jun 2017 14:31:29 GMT https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362633#M160575 srinivasup 2017-06-23T14:31:29Z https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362634#M160576 <P>You are right; I only did half the work; see the updated answer.</P> Fri, 23 Jun 2017 16:34:43 GMT https://community.splunk.com/t5/Splunk-Search/Need-splunk-query-to-get-alerts-saved-searches-dashboards/m-p/362634#M160576 woodcock 2017-06-23T16:34:43Z