To see all disabled saved searches, i.e. alerts & reports, use the "All configurations" listing which you can find under "Settings". App context "Search & Reporting (search)" and search for "savedsearch" or use this link:
The easy to customise solution is the REST API (thanks to @dwaddle's answer). To find alerts, use
alerts.track=1 and the status can be retrieved from the field
disabled. Here a full request:
| rest /services/saved/searches | search alert.track=1 | sort -disabled | eval condition=if(alert_type=="custom", alert_condition, alert_type." ".alert_comparator." ".alert_threshold) | table disabled title condition cron_schedule dispatch.earliest_time dispatch.latest_time alert.suppress.period search alert.digest_mode alert.severity action.email.to
You cannot. At least, not in a way that your installation will continue to be supported by Splunk support. The 'alerts' page at http://localhost:8000/en-US/app/search/alerts is not a standard XML or HTML dashboard. It is based on core Backbone.js routers and views and is in a part of the overall Splunk web UI that is not intended to be user modified.
If you are willing to dive deep into the internals of the Splunk UI, put your support in jeopardy, and do things that will be replaced every time you patch you can start to look in
$SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/views/alerts/table/Master.js and see how the page is assembled. I wouldn't recommend it though, especially not for production. You're kinda on your own there.
There's two things I hear here that could be reasonable ERs -
I would suggest you submit an Enhancement request for it. In the meanwhile you can use the
| rest command to build a dashboard of enabled alerts which may suit your purpose partially.
Thanks for your detailed answer. I better don't change any code in Splunk itself as it would be overridden on each Splunk update.
Thanks for the REST API hint. I explicated it in my answer.