How to create an alert using savedsearches.conf splunk btool savedsearches list

[human96]

I think savedsearches.conf contains information about alerts and reports. If you execute the following btool command and check the result, which is the report or the alert? I can't tell.

if i use splunk btool savedsearches list

<Question 1>

From the btool results, what parameters can I look at to determine that the stanza is a report?

<Question 2>

From the btool results, what parameters can I look at to determine that the stanza is an alert?

[isoutamo]

Hi

When you create an alert and report from exactly same search you can do a diff for those like this.

diff -au report alert
--- report	2022-02-14 13:32:07.000000000 +0200
+++ alert	2022-02-14 13:32:17.000000000 +0200
@@ -1,6 +1,5 @@
-[SSL Cert exp report]
+[SSL Cert exp alert]
 action.email = 0
-action.email.useNSSubject = 1
 action.populate_lookup = 0
 action.rss = 0
 action.script = 0
@@ -10,11 +9,11 @@
 alert.expires = 24h
 alert.managedBy =
 alert.severity = 3
-alert.suppress =
+alert.suppress = 0
 alert.suppress.fields =
 alert.suppress.group_name =
 alert.suppress.period =
-alert.track = 0
+alert.track = 1
 alert_condition =
 allow_skew = 0
 auto_summarize = 0
@@ -32,7 +31,7 @@
 auto_summarize.suspend_period = 24h
 auto_summarize.timespan =
 auto_summarize.workload_pool =
-counttype = always
+counttype = number of events
 cron_schedule = 0 6 * * 1
 defer_scheduled_searchable_idxc = 0
 description =
@@ -392,7 +391,7 @@
 display.visualizations.mapping.tileLayer.tileOpacity = 1
 display.visualizations.mapping.tileLayer.url =
 display.visualizations.mapping.type = marker
-display.visualizations.show = 0
+display.visualizations.show = 1
 display.visualizations.singlevalue.afterLabel =
 display.visualizations.singlevalue.beforeLabel =
 display.visualizations.singlevalue.colorBy = value

 Based on that example it could be hard to separate those 100% sure from each other. It depend which kind of methods you are using for alerts (here I used "Add to triggered alerts").

So maybe fields: alert.suppress, alert.track can be those fields in general case? Of course if you have always some alert.actions in use you could look that from those outputs to check if it exists or not.

r. Ismo