topic Re: How can I write a search that will list all the saved reports in my splunk environment? in Splunk Search

How can I write a search that will list all the saved reports in my splunk environment?

saikatr — Thu, 05 Mar 2015 14:11:44 GMT

I need to write search queries to list all the dashboards and reports saved in my splunk environment. I was able to list the dashboards by using

| rest /servicesNS/-/-/data/ui/views | search isDashboard=1 | search eai:acl.app=search |

but I am unable to write a query for the latter.

i thought | rest /servicesNS/-/-/data/ui/views | would at least list all the reports (among other views) and i would be able to filter the rest out. Unfortunately, this isn't even listing all the reports available to me.

I am a new user and any help is greatly appreciated.

Re: How can I write a search that will list all the saved reports in my splunk environment?

MuS — Thu, 05 Mar 2015 14:37:39 GMT

Hi saikatr,

how about using this REST endpoint:

| rest /services/saved/searches

cheers, MuS

Re: How can I write a search that will list all the saved reports in my splunk environment?

saikatr — Mon, 28 Sep 2020 19:05:32 GMT

Thanks MuS,

This clearly sets me on the right path, This gave me a nice mix of reports and alerts:

| rest /services/saved/searches/ | search is_visible=1 | fields title is_scheduled is_visible eai:acl.perms.write eai:acl.sharing

Would you by any chance be able to test this query and inform what might be the critical step to be able to list the reports and alerts separately?

Re: How can I write a search that will list all the saved reports in my splunk environment?

astackpole — Tue, 12 Oct 2021 15:16:40 GMT

Did you ever get this resolved?

I see this is an old comment but am trying to accomplish the same thing now as well (list reports and alerts in separate dashboard panels).

Re: How can I write a search that will list all the saved reports in my splunk environment?

dwraesner — Sat, 04 Feb 2023 14:23:38 GMT

Hello,

This is definitely an old post, but can anyone share how they have created a search to accurately list whether a saved search is either a report or an alert.

This list exists under the menu item Searches, Reports & Alerts as the column Type lists whether it's a report or an alert, but the code underneath doesn't seem to be viewable like selecting a panel in a dashboard will show the underlying SPL.

Also that report from Searches, Reports & Alerts which shows the Type doesn't seem to be exportable.

Re: How can I write a search that will list all the saved reports in my splunk environment?

isoutamo — Sat, 04 Feb 2023 15:32:40 GMT

here is my old answer https://community.splunk.com/t5/Monitoring-Splunk/How-do-I-export-all-alerts-to-csv-or-pdf/m-p/629226#M9319

r. Ismo