Alerting

Is there any way to list all the alerts created by particular group, and how can I export those to CSV in Splunk 5.0.3?

sdbandara
Engager

Guys,

I'm using Splunk 5.0.3 and for my job, I need to find out all the alerts that our group created and need to export that to CSV format.

Need your help one this.

Thanks,
Have nice day !!

Labels (1)
Tags (4)
0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

you can search scheduler.log with a search like this.

index=_internal sourcetype=scheduler alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

You can filter on additional fields ie: user=admin or app=search

index=_internal sourcetype=scheduler alert_actions!="" user=admin  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

If you want to filter on role(s) your group is part of you will will need to grab roles from another source and join it to the original search on user

first run this search to create a lookup table with user and roles:

| rest/services/authentication/current-context | dedup username | table username roles | rename username as user | outputlookup user_role.csv

then run this search:

index=_internal sourcetype=scheduler  alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time | join user [|inputlookup user_role.csv] | table savedsearch_name user roles app alert_actions status run_time | search roles=admin

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

you can search scheduler.log with a search like this.

index=_internal sourcetype=scheduler alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

You can filter on additional fields ie: user=admin or app=search

index=_internal sourcetype=scheduler alert_actions!="" user=admin  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

If you want to filter on role(s) your group is part of you will will need to grab roles from another source and join it to the original search on user

first run this search to create a lookup table with user and roles:

| rest/services/authentication/current-context | dedup username | table username roles | rename username as user | outputlookup user_role.csv

then run this search:

index=_internal sourcetype=scheduler  alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time | join user [|inputlookup user_role.csv] | table savedsearch_name user roles app alert_actions status run_time | search roles=admin

putnamblake
Path Finder

Still works in 2020! Great answer

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

under the time picker there is an option to export to .csv

sdbandara
Engager

Sorry got the information thanks 🙂

0 Karma

sdbandara
Engager

Thank Sir !! i will go ahead and check will let you know and the Could you please let me know if there is any way to get export those data

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...