topic Re: How to find all alerts reports, and Dashboards using a specific search string in Splunk Search

How to find all alerts reports, and Dashboards using a specific search string

tdavison76 — Mon, 03 Jun 2024 18:44:24 GMT

Hello, I've been asked to provide a list of all Alerts/Reports/Dashboards that contain the value "You Found a bug!" in the underlying Search.

I have no idea how to do this :).

I manually found one Alert that is using a Search that would match:

source=bluefletch "details.package"="com.siteone.mobilepro" "details.message.environment"=PROD (event=ErrorEvent OR event=ExceptionEvent) "details.message.additionalInfo.content{}.Title"="You found a bug!"

I just need to find all of the other Alerts/Reports/Dashboards that also is using this.

Does anyone have any ideas how this can be done. Thank you for any help on this.

Thanks,

Tom

Re: How to find all alerts reports, and Dashboards using a specific search string

richgalloway — Tue, 04 Jun 2024 13:16:06 GMT

There are two REST endpoints you can use to get that information.

This one fetches saved searches (including reports and alerts)

| rest splunk_server=local /servicesNS/-/-/saved/searches | search search="*You found a bug!*"

This one does the same for dashboards.

| rest splunk_server=local /services/-/-/data/ui/views | search eai:data="*You found a bug!*"

Re: How to find all alerts reports, and Dashboards using a specific search string

PickleRick — Tue, 04 Jun 2024 08:10:20 GMT

Having said that - as with most of the questions starting with "how to find all" - it's possible to do it only for a specific subset of cases. There are ways of creating the searches so that you won't know what they're using effectively for searching (aliases, eventtypes, tags, subsearches, lookups...).

Re: How to find all alerts reports, and Dashboards using a specific search string

tdavison76 — Tue, 04 Jun 2024 12:47:28 GMT

Awesome, thanks for the help, much appreciated. This worked for me. 🙂

Thanks again,

Tom