Alerting

Does a search variable in filter exception within search command require special handling?

pm771
Communicator

This is my 2nd follow-up regarding this solution:  https://community.splunk.com/t5/Alerting/How-can-I-query-to-get-all-alerts-which-are-configured/m-p/...  

My question now is about the search field (that contains the actual Splunk query behind each alert).  Does this field require any special handling?

If I need to use this field for filtering purposes inside a search command, would it be different than using any other field like title.

Or can I simply use something like following:

 

|rest/servicesNS/-/-/saved/searches | search alert.track=1 AND title="prefix*" AND search="index=someindex*"

 



 

Labels (1)
0 Karma

pm771
Communicator

@richgalloway 

I understand that. My question was specific to search field that that is a part of REST call return. 

Is REST call similar to sub-search in regards to the special meaning of search field?

Like something similar to https://community.splunk.com/t5/Splunk-Search/Subsearch-fields-quot-query-quot-quot-search-quot-How-...

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's just a field.  There's nothing wrong or special about 

| search search=foo
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

When you run a query without a leading | character you are running an implicit search command.  Explicit search commands are very much the same.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...