We have over 200 configured alerts and I would like to generate a report of the configured alerts with their properties, such as who the alerts are going to. I'm guessing there is a way to do that with a Splunk search, but not sure where to start. Is it that data in some internal index?
You would need a SPlunk REST search to get the information. This search should get you started.
| rest /services/saved/searches | search action.email=1 AND is_scheduled=1
More details here. http://docs.splunk.com/Documentation/Splunk/6.2.1/RESTREF/RESTsearch#saved.2Fsearches
You would need a SPlunk REST search to get the information. This search should get you started.
| rest /services/saved/searches | search action.email=1 AND is_scheduled=1
More details here. http://docs.splunk.com/Documentation/Splunk/6.2.1/RESTREF/RESTsearch#saved.2Fsearches
Tried | REST /services/saved/searches
and it gave me only a few of the saved searches.
Did some more searching now that I know about REST and tried | REST /servicesNS/-/-/saved/searches
which gave me a few more but still not all of the saved searches.
Finally, I found | REST splunk_server=local /servicesNS/-/-/saved/searches
which gave me all of the saved searches and now I can filter down from there.
Thanks!