How to create a report on configured alerts and their properties, such as who the alerts are sent to?

[cmulkey2]

We have over 200 configured alerts and I would like to generate a report of the configured alerts with their properties, such as who the alerts are going to. I'm guessing there is a way to do that with a Splunk search, but not sure where to start. Is it that data in some internal index?

[somesoni2 · Accepted solution]

You would need a SPlunk REST search to get the information. This search should get you started.

| rest /services/saved/searches | search action.email=1 AND is_scheduled=1

More details here. http://docs.splunk.com/Documentation/Splunk/6.2.1/RESTREF/RESTsearch#saved.2Fsearches

[cmulkey2]

Tried | REST /services/saved/searches and it gave me only a few of the saved searches.

Did some more searching now that I know about REST and tried | REST /servicesNS/-/-/saved/searches which gave me a few more but still not all of the saved searches.

Finally, I found | REST splunk_server=local /servicesNS/-/-/saved/searches which gave me all of the saved searches and now I can filter down from there.

Thanks!