I think savedsearches.conf contains information about alerts and reports. If you execute the following btool command and check the result, which is the report or the alert? I can't tell.
if i use splunk btool savedsearches list
<Question 1>
From the btool results, what parameters can I look at to determine that the stanza is a report?
<Question 2>
From the btool results, what parameters can I look at to determine that the stanza is an alert?
Hi
When you create an alert and report from exactly same search you can do a diff for those like this.
diff -au report alert
--- report 2022-02-14 13:32:07.000000000 +0200
+++ alert 2022-02-14 13:32:17.000000000 +0200
@@ -1,6 +1,5 @@
-[SSL Cert exp report]
+[SSL Cert exp alert]
action.email = 0
-action.email.useNSSubject = 1
action.populate_lookup = 0
action.rss = 0
action.script = 0
@@ -10,11 +9,11 @@
alert.expires = 24h
alert.managedBy =
alert.severity = 3
-alert.suppress =
+alert.suppress = 0
alert.suppress.fields =
alert.suppress.group_name =
alert.suppress.period =
-alert.track = 0
+alert.track = 1
alert_condition =
allow_skew = 0
auto_summarize = 0
@@ -32,7 +31,7 @@
auto_summarize.suspend_period = 24h
auto_summarize.timespan =
auto_summarize.workload_pool =
-counttype = always
+counttype = number of events
cron_schedule = 0 6 * * 1
defer_scheduled_searchable_idxc = 0
description =
@@ -392,7 +391,7 @@
display.visualizations.mapping.tileLayer.tileOpacity = 1
display.visualizations.mapping.tileLayer.url =
display.visualizations.mapping.type = marker
-display.visualizations.show = 0
+display.visualizations.show = 1
display.visualizations.singlevalue.afterLabel =
display.visualizations.singlevalue.beforeLabel =
display.visualizations.singlevalue.colorBy = value
Based on that example it could be hard to separate those 100% sure from each other. It depend which kind of methods you are using for alerts (here I used "Add to triggered alerts").
So maybe fields: alert.suppress, alert.track can be those fields in general case? Of course if you have always some alert.actions in use you could look that from those outputs to check if it exists or not.
r. Ismo