Alerting

Is there any way to list all the alerts created by particular group, and how can I export those to CSV in Splunk 5.0.3?

sdbandara
Engager

Guys,

I'm using Splunk 5.0.3 and for my job, I need to find out all the alerts that our group created and need to export that to CSV format.

Need your help one this.

Thanks,
Have nice day !!

Labels (1)
Tags (4)
0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

you can search scheduler.log with a search like this.

index=_internal sourcetype=scheduler alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

You can filter on additional fields ie: user=admin or app=search

index=_internal sourcetype=scheduler alert_actions!="" user=admin  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

If you want to filter on role(s) your group is part of you will will need to grab roles from another source and join it to the original search on user

first run this search to create a lookup table with user and roles:

| rest/services/authentication/current-context | dedup username | table username roles | rename username as user | outputlookup user_role.csv

then run this search:

index=_internal sourcetype=scheduler  alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time | join user [|inputlookup user_role.csv] | table savedsearch_name user roles app alert_actions status run_time | search roles=admin

View solution in original post

rphillips_splk
Splunk Employee
Splunk Employee

you can search scheduler.log with a search like this.

index=_internal sourcetype=scheduler alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

You can filter on additional fields ie: user=admin or app=search

index=_internal sourcetype=scheduler alert_actions!="" user=admin  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

If you want to filter on role(s) your group is part of you will will need to grab roles from another source and join it to the original search on user

first run this search to create a lookup table with user and roles:

| rest/services/authentication/current-context | dedup username | table username roles | rename username as user | outputlookup user_role.csv

then run this search:

index=_internal sourcetype=scheduler  alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time | join user [|inputlookup user_role.csv] | table savedsearch_name user roles app alert_actions status run_time | search roles=admin

putnamblake
Path Finder

Still works in 2020! Great answer

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

under the time picker there is an option to export to .csv

sdbandara
Engager

Sorry got the information thanks 🙂

0 Karma

sdbandara
Engager

Thank Sir !! i will go ahead and check will let you know and the Could you please let me know if there is any way to get export those data

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...