Is there any way to list all the alerts created by particular group, and how can I export those to CSV in Splunk 5.0.3?

[sdbandara]

Guys,

I'm using Splunk 5.0.3 and for my job, I need to find out all the alerts that our group created and need to export that to CSV format.

Need your help one this.

Thanks,
Have nice day !!

[rphillips_splk · Accepted solution]

you can search scheduler.log with a search like this.

index=_internal sourcetype=scheduler alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

You can filter on additional fields ie: user=admin or app=search

index=_internal sourcetype=scheduler alert_actions!="" user=admin  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time

If you want to filter on role(s) your group is part of you will will need to grab roles from another source and join it to the original search on user

first run this search to create a lookup table with user and roles:

| rest/services/authentication/current-context | dedup username | table username roles | rename username as user | outputlookup user_role.csv

then run this search:

index=_internal sourcetype=scheduler  alert_actions!=""  | dedup savedsearch_name | table savedsearch_name user app alert_actions status run_time | join user [|inputlookup user_role.csv] | table savedsearch_name user roles app alert_actions status run_time | search roles=admin

[putnamblake]

Still works in 2020! Great answer

[rphillips_splk]

under the time picker there is an option to export to .csv

[sdbandara]

Sorry got the information thanks 🙂

[sdbandara]

Thank Sir !! i will go ahead and check will let you know and the Could you please let me know if there is any way to get export those data