Alerting

Can you get metadata from an alert or report in search?

eli_mz
Explorer

I'd like to run a search that would give me the metadata for all reports\alerts (creator, app, schedule, etc.) so that I can view all of this information on a single page. Is this possible? The main goal of this is to look at all scheduled report\alert times and see if there's any time where the reports\alerts are running more. So to be clear, I'm not after fired alerts, I'm after the schedule (though I suppose I could use the times on the fired alerts... hmm).

Any how, I'm open to suggestions and discussion. 😄

0 Karma
1 Solution

somesoni2
Revered Legend

If your prime purpose is to identify times where you've too many searches running, you could use internal log of the splunk scheduler. The base query will be this

index=_internal sourcetype=scheduler

The logs will have important fields like scheduled_time (time when the scheduled report/alert was scheduled to run), dispatch_time (time when it actually started to run) and status (status of the report/alert). You can then run necessary aggregation command to find the report you want.

If you just want to list all searches/reports, you can use | rest command to do so, which gives all the metadata about the search.

| rest splunk_server=local /servicesNS/-/-/saved/searches 

View solution in original post

0 Karma

somesoni2
Revered Legend

If your prime purpose is to identify times where you've too many searches running, you could use internal log of the splunk scheduler. The base query will be this

index=_internal sourcetype=scheduler

The logs will have important fields like scheduled_time (time when the scheduled report/alert was scheduled to run), dispatch_time (time when it actually started to run) and status (status of the report/alert). You can then run necessary aggregation command to find the report you want.

If you just want to list all searches/reports, you can use | rest command to do so, which gives all the metadata about the search.

| rest splunk_server=local /servicesNS/-/-/saved/searches 
0 Karma

AVOLLMER
Explorer

From the result set returned by the rest api call, is there a way to identify which are alerts and which are reports?

0 Karma

eli_mz
Explorer

I think I can work with that. Thank you!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...