Alerting

How to view list of email addresses for saved alerts?

New Member

We have a large number of saved alerts (250+). I have been asked to review the email distribution list for every one of these to identify addresses for people who no longer work for the company and remove them. There is some assumption that Splunk should make this an easy (click a couple buttons and view a consolidated list for all alerts). I have told them this is not the case (as far as I can tell). Is there a way through the web GUI or otherwise to dump this information for each alert?

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

You can utilize Splunk's Rest API endpoints to get all the searches (in the box where the search will run).

Try something like this

| rest /services/saved/searches  | table title *

Full details of the output of this command is available here.
http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTsearch#saved.2Fsearches

Based on your requirement, you can set filters from the output fields.

0 Karma

SplunkTrust
SplunkTrust

You need to use namespace wildcards to get all the searches (run as admin), I've added a filter to only load searches that have the email action enabled:

| rest /servicesNS/-/-/saved/searches search="action.email=1" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule action.email*

Contributor

@martin_mueller - Perfect!

0 Karma

New Member

That returned some results. Out of the 250+ searchers it returned 24.

0 Karma

New Member

Thank you, I will give it a try.

0 Karma