Alerting

Rest API not returning alerts

Engager

I am using the REST API to create a bot to search for triggered alerts every 30 seconds or so. I created saved searches as alerts on my personal splunk account from my company and everything worked fine.

curl -k -u [username]:[password] https://[host]/servicesNS/[username]/[app]/alerts/fired_alerts -d "output_mode=json" --get

I recently got a new splunk account specifically for the bot to use so I went and recreated the alerts I had previously created on the new account but when I run the API calls I am not getting any triggered alerts returned. I can see my test alerts in the alert manager and the alerts I created on the new account are exactly the same as the ones I had on my personal account.

I have tried deleting the saved searches on my personal account as well as recreating the searches on the bot account but I am unable to see the triggered alerts when I check for them using the API.

Any help would greatly appreciated.

edit: If I search for triggered alerts from all apps I am able to see other alerts that were created by other people but not the ones I created.

I can see the alerts that were triggered http://i.imgur.com/NcoDyy7.png but when I run the command I only get http://pastebin.com/6N9r82k1

Tags (4)
0 Karma

Engager

Is it a namespace issue?

Try here
https://answers.splunk.com/answers/146985/how-to-view-list-of-email-addresses-for-saved-alerts.html

You need to use namespace wildcards to get all the searches (run as admin), I've added a filter to only load searches that have the email action enabled:
 | rest /servicesNS/-/-/saved/searches search="action.email=1" | table title eai:acl.app eai:acl.owner disabled is_scheduled cron_schedule action.email*

I also found these pages helpful

http://docs.splunk.com/Documentation/Splunk/6.0.2/RESTAPI/RESTsearch

http://docs.splunk.com/Documentation/Splunk/6.2.2/RESTREF/RESTsearchExamples

0 Karma

Splunk Employee
Splunk Employee

Hmmm this worked for me:

curl --get -ku admin:xxxxx https://localhost:9621/servicesNS/admin/sales/alerts/fired_alerts -d "output_mode=json"

Try --get upfront.

0 Karma

Engager

I get the same results when I run both commands
http://pastebin.com/6N9r82k1

It says no alerts have been fired but when I go to the alert manager I see http://i.imgur.com/NcoDyy7.png

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!