Alerting

How to query all dashboards and alerts queries?

sarit_s
Communicator

Hello
I have to find all the alerts and dashboards queries by sourcetype
i saw this query but it is not contains the query inside the dashboard\alert

 

| union 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
    | search "eai:data"="*index=*" 
    | eval Type="Dashboards" 
    | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write] 


    [| rest splunk_server="local" "/servicesNS/-/-/admin/macros"
    | search definition="*index=*"
    | eval Type="Macros"
    | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write]

    [| rest splunk_server="local" "/servicesNS/-/-/saved/searches"
    | search search="*index=*"
    | eval Type="Saved Searches/Alerts/Reports"
    | table Type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write]

 

maybe there is another way to achieve my goal ?  

 

thanks

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can retrieve the source code of the dashboards. However, there is no guarantee that the sourcetypes are easily extractable from the source code. Indeed, since dashboards are interactive, there is no guarantee that the sourcetype is actually fixed in the dashboard source code.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...