Is it possible to export all triggered alerts with alert name, trigger condition(s), and severity?

[sophiavc]

Hi,

I'm wondering if it's possible to get an export of all triggered alerts including the alert name, alert trigger condition(s)/alert query, and alert severity as a table (CSV or JSON preferably)?

I can access the triggered alerts from Activity > Triggered Alerts and all configured alerts from Search & Reporting Alerts but have not found a straightforward way to export everything.

For the alert trigger condition(s)/query, I'm looking specifically for what index(es), field(s), and field value(s) the alert is monitoring for.

Thanks in advance!

[richgalloway]

There are REST commands to get all of that.

| rest /servicesNS/-/-/alerts/fired_alerts/ will give you a list of triggered alerts

| rest /servicesNS/-/-/saved/searches splunk_server=local | search alert_type!="always" will provide a list of all alerts, including the search string.

The trick (perhaps worthy of a Master's thesis) is to parse the search string to discover what the alert is looking for.  If you're lucky, the alert.comparator, alert.threshold, and alert.condition fields will tell you which fields will trigger the alert, but most of the time that will not be so obvious.

The index and field names sought may be explicitly mentioned in the search or they could be hidden in a macro, eventtype, datamodel, or tag.  Index names may be unnamed completely and come from the user's default index list.