Alerting

Can you get metadata from an alert or report in search?

eli_mz
Explorer

I'd like to run a search that would give me the metadata for all reports\alerts (creator, app, schedule, etc.) so that I can view all of this information on a single page. Is this possible? The main goal of this is to look at all scheduled report\alert times and see if there's any time where the reports\alerts are running more. So to be clear, I'm not after fired alerts, I'm after the schedule (though I suppose I could use the times on the fired alerts... hmm).

Any how, I'm open to suggestions and discussion. 😄

0 Karma
1 Solution

somesoni2
Revered Legend

If your prime purpose is to identify times where you've too many searches running, you could use internal log of the splunk scheduler. The base query will be this

index=_internal sourcetype=scheduler

The logs will have important fields like scheduled_time (time when the scheduled report/alert was scheduled to run), dispatch_time (time when it actually started to run) and status (status of the report/alert). You can then run necessary aggregation command to find the report you want.

If you just want to list all searches/reports, you can use | rest command to do so, which gives all the metadata about the search.

| rest splunk_server=local /servicesNS/-/-/saved/searches 

View solution in original post

0 Karma

somesoni2
Revered Legend

If your prime purpose is to identify times where you've too many searches running, you could use internal log of the splunk scheduler. The base query will be this

index=_internal sourcetype=scheduler

The logs will have important fields like scheduled_time (time when the scheduled report/alert was scheduled to run), dispatch_time (time when it actually started to run) and status (status of the report/alert). You can then run necessary aggregation command to find the report you want.

If you just want to list all searches/reports, you can use | rest command to do so, which gives all the metadata about the search.

| rest splunk_server=local /servicesNS/-/-/saved/searches 
0 Karma

AVOLLMER
Explorer

From the result set returned by the rest api call, is there a way to identify which are alerts and which are reports?

0 Karma

eli_mz
Explorer

I think I can work with that. Thank you!

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...