Alerting

How do you search Splunk for a listing of all alerts that are being sent to a particular email address?

ChadLangUAB
Path Finder

Does anyone know how to Splunk a listing of all alerts that are sending to a particular email address (e.g. ServiceNow) or get a listing of all alerts by email address they’re being delivered to?

I'm working to analyze our processes and the mechanisms currently being used.

0 Karma
1 Solution

zonistj
Path Finder

You can use the rest function to search for this information:

| rest splunk_server=local count=0 /services/saved/searches
| search eai:acl.app="*" title="*" action.email.to="*"
| table eai:acl.app,title,action.email.to, next_scheduled_time, search

Just replace any of the asterisks to search for specific apps, saved search names, or the email recipient. You can add "action.email.cc" to include any CC addresses.

View solution in original post

0 Karma

zonistj
Path Finder

You can use the rest function to search for this information:

| rest splunk_server=local count=0 /services/saved/searches
| search eai:acl.app="*" title="*" action.email.to="*"
| table eai:acl.app,title,action.email.to, next_scheduled_time, search

Just replace any of the asterisks to search for specific apps, saved search names, or the email recipient. You can add "action.email.cc" to include any CC addresses.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...