topic Re: How to search to find disabled alert? in Splunk Search

How to search to find disabled alert?

kimberlytrayson — Tue, 28 Feb 2023 19:00:41 GMT

Hi!

I'm using Splunk cloud. Trying to create alert to catch event when someone disabling alert.
Need advice on the search for this alert, since has no luck with digging into `index=_* disbled_alert_name`

Re: Search to find disabled alert

gcusello — Tue, 28 Feb 2023 13:50:19 GMT

Hi @kimberlytrayson,

with this command you have the list pf all savedsearches, so you can identify the disabled ones:

| rest /servicesNS/-/-/saved/searches splunk_server=local

Ciao.

Giuseppe

Re: Search to find disabled alert

Brausepaule — Tue, 28 Feb 2023 13:52:09 GMT

Hi,

all alerts should be saved searches and you can query them like explained here:
https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/td-p/288845

as you only want to find disabled alerts (there are already a lot by default) you should only scan for line items where disabled=1

do that in a saved search itself quering all disabled saved searches..and it should work

Re: Search to find disabled alert

kimberlytrayson — Tue, 28 Feb 2023 20:26:33 GMT

Hi, @Brausepaule , this is not exactly what I'm looking for, but maybe I can get something out of it.

I'm looking for a way to catch event when someone disabling the alert. Suggested search doesn't return information about who disabled the alert and when.

Re: Search to find disabled alert

kimberlytrayson — Tue, 28 Feb 2023 20:27:11 GMT

Hi, @gcusello , this is not exactly what I'm looking for, but maybe I can get something out of it.

I'm looking for a way to catch event when someone disabling the alert. Suggested search doesn't return information about who disabled the alert and when.

Re: How to search to find disabled alert?

Brausepaule — Tue, 28 Feb 2023 20:34:07 GMT

how many users are able to edit your alerts?

Maybe you should revisit your permissions on alerts first 😉

Re: How to search to find disabled alert?

m_pham — Tue, 28 Feb 2023 20:43:53 GMT

There isn't a great way to do this due to Splunk not tracking these types of changes. There is a Splunk idea that Splunk is working on that resolves some of the shortcomings of the current audit log.

https://ideas.splunk.com/ideas/E-I-49